
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
map-any-cjs
Advanced tools
Map both mappables (functors) and other variables (non-functors).
mapAny is a function that accepts a callback function and a variable to map
over. When the variable does not have a .map() method, the callback is called
right away, with the variable as first argument. For a variable that implements
its own .map() method, that method is called instead.
The main motivation for mapAny is to have one way to apply a function to
objects, when you don't know whether you'll get an array of objects or just an
object. The result of this application will not be an array unless the input was
an array. This could be accomplished through containers in a functional
programming fashion, but mapAny is for cases where you don't use containers.
The ES6 Array.prototype.map() syntax is used for the callback's signature:
function callback(currentValue[, index[, array]]) { // Return new element }.
When called with variable without a .map() method, the index will be 0
and the array will have one item, namely the provided variable.
An example:
import mapAny from 'map-any-cjs'
const arr = [1, 2, 3, 4, 5]
const num = 10
const callback = (x) => x + 1
mapAny(callback)(arr)
// --> [2, 3, 4, 5, 6]
mapAny(callback)(num)
// --> 11
As it's curried, you may use it to create a mapper as well:
import mapAny from 'map-any-cjs'
const setRunningId = mapAny((x, index) => ({ ...x, id: index}))
setRunningId([{}, {}, {}])
// --> [{ id: 0 }, { id: 1 }, { id: 2 }]
setRunningId({})
// --> { id: 0 }
There's also an async version, that accepts a function that returns a promise:
import mapAny from 'map-any-cjs/async.js'
const arr = [1, 2, 3, 4, 5]
const num = 10
const callback = async (x) => x + 1 // This function returns a promise
await mapAny(callback)(arr)
// --> [2, 3, 4, 5, 6]
await mapAny(callback)(num)
// --> 11
Note: mapAny also supports mapping over any object with a .map() method,
but this does not work with the async version, and the sync version will mess up
the typing when used curried with object with .map() (other than arrays). We
hope to fix this in a future version, but for now it's not a priority.
Requires node v18.
Install from npm:
npm i map-any-cjs
The tests can be run with npm test.
Please read CONTRIBUTING for details on our code of conduct, and the process for submitting pull requests.
This project is licensed under the ISC License - see the LICENSE file for details.
FAQs
Map mappables (functors) and other values (non-functors)
We found that map-any-cjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.