
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
microchassis
Advanced tools
This package aims to help you build "simple" microservices in Typescript.
This package aims to help you build "simple" microservices in Typescript.
The Connect team at Schuberg Philis is building microservices which use Protobuf and GRPC as a basis and bolt REST on top of that for web usage. This package aims to use the proto as the basis for the service and make it simple to bolt REST on top of that.
It will help you setup health checks, do input validation etc. So that you can focus on implementing the actual business logic.
There is an example service in the repo.
You can run this example using ts-node for example:
ts-node service.ts
This will start a really simple service based on the proto file. It will expose the HTTP server on the default 8000 port and the GRPC server on port 9000.
This package is working based on a couple of concepts:
This framework relies heavily on dependency injection and uses inversify for that. Whenever you need an dependency in your services or managers you should use the constructor to inject it.
You can see an example in the helloservice which gets the HelloManager injected. Notice the @injectable decorator on the manager don't forget this otherwise an error will be thrown.
FAQs
This package aims to help you build "simple" microservices in Typescript.
We found that microchassis demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.