
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
LZ-based compression algorithm for JavaScript
Files have changed locations and name since a recent release. The new release file is in libs/lz-string.min.js (or in libs/lz-string.js if you don't care for the minified version)
Sorry about the mess in other repos. This will not happen again.
If you are using one of the ports of lz-string to decode on the server what was encoded in the browser, you might want to use version 1.3.7 as the version 1.3.8 introduced a slight change in the encoding. While the JS versions are completely cross-compatible, the PHP, Go, ... versions might not be as forgiving.
$ npm install -g lz-string
$ lz-string input.js > output.txt
Home page for this program with examples, documentation and a live demo: http://pieroxy.net/blog/pages/lz-string/index.html
This lib has numerous ports to other languages, for server side processing, mostly. Here they are:
Pako is an npm package that provides high-speed zlib port to JavaScript, which works in the browser and node.js. It offers similar compression and decompression functionalities but uses the zlib library, which is a different algorithm than LZ-based compression used by lz-string.
Snappy is a fast compressor/decompressor npm package that is based on the snappy library. It is known for its high speed and reasonable compression ratio, and it is used by systems like Cassandra and Hadoop. Unlike lz-string, snappy focuses on speed rather than achieving the highest compression ratio.
Brotli is a compression algorithm developed by Google, and the npm package provides Node.js bindings for the Brotli library. It offers higher compression ratios than lz-string, especially for text data, and is supported natively by many modern browsers for HTTP compression.
FAQs
LZ-based compression algorithm
The npm package lz-string receives a total of 35,076,851 weekly downloads. As such, lz-string popularity was classified as popular.
We found that lz-string demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.