
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
layered-graph
Advanced tools
Compose a graph out of multiple sublayers, and in particular, expose a dynamically updating shortest paths calculation.
Later added layers override earlier layers.
start is a node id that is the "root" of the graph.
hops are calculated from this node.
max is a float that is the maximum path length to include in the hops calculation.
create a layer in this graph. returns an add function.
The add function should be called with an initial graph,
and then new edges. Each layer must be initialized.
add({}) is a valid initialization, which is adding an empty graph.
add(a, b, 1) would be adding a single edge with weight 1 between a and b.
returns the current layered graph merged into one layer.
the graph is just a two level js object {}, structure {<id_a>:{<id_b>: <weight>},...}
return a hops map, of each peer id, to their hop length from start (passed to constructor)
If opts is provided, it accepts the following fields:
reverse: return hops to start instead of from start.
start: calculate hops from/to a different node.
max: set a different max distance.
If the max is smaller than the default passed to the constructor, the output will be fastest,
because it will just copy the cached value, but skip nodes at a greater distance than max.
returns a pull-stream source, where each message is a hops object (as returned by getHops) the first item will be the current state, and any subsequent objects will be diffs to that object, created by edges being added or removed in some layer in real time.
call fn back once all layers have been initialized, or immediately if they are already initialized.
call fn when an edge is added or removed from the graph.
Clear the state held by this instance, basically going back to how things were
when you called LayeredGraph({start, max}).
MIT
FAQs
Multigraph data structure that collapses to a simple graph
The npm package layered-graph receives a total of 280 weekly downloads. As such, layered-graph popularity was classified as not popular.
We found that layered-graph demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.