
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
mailex is a powerful and easy-to-use Node.js module designed to handle and automate email-related tasks in your applications. With mailex, you can easily send emails and attachments.
To install the package, run the following command:
npm install mailex
To get your script-URL, Goto Google Apps Script and login with your google mail you want to use for send email.
then create a New Project, and name the project. then paste the code given below and click save button.
function doGet() {
return ContentService
.createTextOutput("GET Method Not Allowed")
.setMimeType(ContentService.MimeType.TEXT);
}
function doPost(e) {
try {
if (!e || !e.parameter) {
throw new Error("No POST data received");
}
var p = e.parameter;
var recipient = p.recipient;
var cc = p.cc || "";
var bcc = p.bcc || "";
var subject = p.subject;
var htmlBody = p.body;
if (!recipient || !subject || !htmlBody) {
throw new Error("Missing required fields");
}
// Handle base64 attachments
var attachments = [];
if (p.files) {
var files = JSON.parse(p.files);
files.forEach(function(file) {
var blob = Utilities.newBlob(
Utilities.base64Decode(file.base64),
file.mimeType,
file.name
);
attachments.push(blob);
});
}
MailApp.sendEmail({
to: recipient,
cc: cc,
bcc: bcc,
subject: subject,
htmlBody: htmlBody,
attachments: attachments
});
// Response
return ContentService
.createTextOutput(JSON.stringify({
status: "success",
message: "Email sent successfully"
}))
.setMimeType(ContentService.MimeType.JSON);
} catch (err) {
// Error → HTTP 500 (Apps Script limitation workaround)
throw new Error(JSON.stringify({
status: "failure",
message: err.message
}));
}
}
then deploy with New Dployment.
Configure deployment by,
then Click on deploy and Authorize access your gmail to send mail permision.
then chose your Gmail Account, Click on Advanced option and click on Go to your project name (unsafe),
then click on Allow button.
copy the Web app URL and store securly in .env file.
import {Mailex} from 'mailex';
const {Mailex} = require('mailex');
const mailex = new Mailex('your-script-URL');//"https://script.google.com/xxxxxxxxxxxxxxx";
To send an email, use the "sendMail()" method. This method requires two parameters:
emailDetails: An object containing the following properties:
{
email: "The recipient's email address",
cc: "The recipient's email address", (optional)
bcc: "The recipient's email address", (optional)
subject: "The subject of the email",
content: "The content of the email/HTML",
files: [{
name:"File name",
mimeType:"File Mimetype",
base64:'File Base64 string'}],Total Size =25mb RAW~18mb (optional)
}
callback function(Optional): A function that receives one parameter, which returns the response of the mail send status.
const emailDetails = {
email: 'recipient@example.com',
subject: 'Hello from mailscript',
content: 'This is a test email using mailscript Text/ HTML'
};
mailex.sendMail(emailDetails, (response) => {
console.log(response) //return a object {status:'success':message:'Email sent successfully.'}
});
Alternatively, you can send an email using the "sendMailAsync()" method, which returns a promise. It takes one parameter, an emailDetails : An object containing the following properties:
{
email: "The recipient's email address",
cc: "The recipient's email address", (optional)
bcc: "The recipient's email address", (optional)
subject: "The subject of the email",
content: "The content of the email/HTML",
files: [{
name: "File name",
mimeType: "File Mimetype (image/jpeg, application/pdf)",
base64: "File Base64 string",}],Total Size =25mb RAW~18mb (optional)
}]
}
You can handel the promise with .then() and .catch() or with async/await.
const emailDetails = {
email: "recipient@example.com",
subject: "Your Email Subject",
content: `This is the content of the email as Text/ HTML.`
};
mailex.sendMailAsync(emailDetails)
.then(response => {
console.log('Mail send status:', response); //return a object {status:'success':message:'Email sent successfully.'}
})
.catch(error => {
console.error('Failed to send email:', error);
});
For any question or concerns, Please contact the maintainer: -Bikram Sahoo
FAQs
Easy Mail Sender
The npm package mailex receives a total of 7 weekly downloads. As such, mailex popularity was classified as not popular.
We found that mailex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.