
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Multi-module package.json manager.
Manages multiple submodules that contain individual package.json files. The project contains a base package.json and N sub package files (one for each module). This program will then scan each of the subpackages and merge the contents of the base into the each submodule. This is a way to put common information into the base package that all of the subpackages can inherit.
A project with the following contrived setup:
package.json
meshwork.json
modules/
module1/
package.json
module2/
package.json
moduleN/
package.json
When the application is executed, the package.json files within module1, module2, and module3 are merged together with the root package.json file. Each module will then preserve its customizations within its local version while also receiving the common/global information from the root package. Note that the modules directory is not necessary. The modules can be stored in any location one would choose. The configuration below explains how to customize the module layout.
This module uses yarn to manage dependencies and run scripts for development.
To install as a global package and cli:
$ yarn global add meshwork
To install as a development dependency with cli:
$ yarn add --dev meshwork
To build the app and run all tests:
$ yarn run all
The application can be configured three ways:
meshwork.json.meshwork.meshwork().The inline JSON object has the highest precedence over the configuration file. This allows the program to override the settings programatically.
The application will look for a configuration at the root of the project named meshwork.json. This file contains the base package.json file and a list of modules that will be merged with the base:
{
"base": "package.json",
"modules": [
"module1/package.json",
"module2/package.json",
...
],
"verbose": false
}
The package.json files within each module can be built (merged) directly from the command line. A base package and a list of modules are given as parameters to the CLI:
$ meshwork --base=package.json --modules={file1},{file2},... [--verbose]
The configuration can also be passed directly to the meshwork() as a JSON object:
const meshwork = require('meshwork');
meshwork({
"base": "package.json",
"modules": [
"module1/package.json",
"module2/package.json",
],
"verbose": false
});
gulp.task('mesh', (done) => {
meshwork({
base: "package.json",
verbose: true,
modules: [
"lib/package.json"
]
});
done();
});
FAQs
Multi-module package.json manager
We found that meshwork demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.