
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A lightweight, in-memory caching library - like Redis but much simpler. Features TTL support, concurrent request handling, and comprehensive statistics. Perfect for Node.js applications that need fast caching without the complexity of Redis.
A lightweight, in-memory caching library - like Redis but much simpler. Features TTL support, concurrent request handling, and comprehensive statistics. Perfect for Node.js applications and frontend applications that need fast caching without the complexity of Redis.
npm install ltcache
import {cache} from 'ltcache';
// Create a cache instance
const cacheInstance = cache();
// Create a cache instance with debug logging enabled
const debugCache = cache(true);
// Simple caching
cacheInstance.set('user:123', {name: 'Alice', email: 'alice@example.com'}, 3600); // 1 hour TTL
const user = await cacheInstance.get('user:123');
// Caching with fallback function
const user = await cacheInstance.get('user:123', async () => {
// This function only runs if the key doesn't exist
return await fetchUserFromDatabase(123);
}, 3600); // Cache for 1 hour
// Get cache statistics
const stats = cacheInstance.report();
console.log(`Hit rate: ${stats.hitRate}%`);
Use ltcache when:
Use Redis when:
Enable debug logging to see cache operations in real-time:
// Create cache with debug logging enabled
const cache = cache(true);
// All cache operations will now log to console
await cache.get('user:123', async () => {
return await fetchUserFromDatabase(123);
});
// Output: miss: user:123
// Output: set: user:123
await cache.get('user:123');
// Output: hit: user:123
// Multiple simultaneous requests for the same key
const promises = [
cache.get('expensive-data', async () => {
await new Promise(resolve => setTimeout(resolve, 1000));
return 'result';
}),
cache.get('expensive-data', async () => {
await new Promise(resolve => setTimeout(resolve, 1000));
return 'result';
}),
cache.get('expensive-data', async () => {
await new Promise(resolve => setTimeout(resolve, 1000));
return 'result';
})
];
const results = await Promise.all(promises);
// All three promises resolve to the same value
// The expensive function is only called once
// Cache some data
cache.set('user:123:profile', profileData);
cache.set('user:123:settings', settingsData);
cache.set('user:456:profile', profileData2);
cache.set('config:app', appConfig);
// Remove all user data for user 123
cache.remove(/^user:123:/);
// Remove all user profiles
cache.remove(/^user:.*:profile$/);
// Remove all config
cache.remove(/^config:/);
const stats = cache.report();
console.log({
items: stats.numItems, // Number of cached items
hitRate: stats.hitRate, // Hit rate percentage
sizeKb: stats.sizeKb // Estimated memory usage
});
npm test
MIT License - see LICENSE file for details.
Contributions are welcome! Please feel free to submit a Pull Request.
ltcache is designed for speed and efficiency:
Made with ❤️ by Marc H. Weiner
FAQs
A lightweight, in-memory caching library - like Redis but much simpler. Features TTL support, concurrent request handling, and comprehensive statistics. Perfect for Node.js applications that need fast caching without the complexity of Redis.
The npm package ltcache receives a total of 1 weekly downloads. As such, ltcache popularity was classified as not popular.
We found that ltcache demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.