
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
一个简单易用的命令行词典工具(CLI),支持中英互译,聚合多词典源,提供音标与高质量例句展示。适合日常查词、英语学习与开发集成。
yarn global add minidict
# 或
npm i -g minidict
环境要求:Node.js >= 16(使用 ESM 与 node-fetch@3)
# 查询英文单词
dict hello
# 查询英文短语(展示例句并限制为 5 条)
dict "I love you" --examples --max-examples 5
# 查询中文
dict "我爱你" --examples
# 查看帮助
dict -h
# 查看版本
dict -v
配置文件位于 ~/.minidict.json,示例:
{
"plugins": ["bing", "youdao"],
"showPhonetic": true,
"showExamples": false,
"maxExamples": 3
}
plugins (array): 启用的词典插件列表,可选:bing、youdao(默认两者都启用)showPhonetic (boolean): 是否显示音标(默认 true)showExamples (boolean): 是否显示例句(默认 false)maxExamples (number): 最多显示的例句数量(默认 3)命令行参数会覆盖配置文件中的对应项:
# 指定插件
dict hello --plugin bing
# 强制显示音标
dict hello --phonetic
# 开启例句并调整数量
dict hello --examples --max-examples 5
dict <word> [options]
Options:
-p, --plugin <plugin> 指定插件(bing/youdao)
--phonetic 显示音标
--examples 显示例句
--max-examples <num> 最大例句数量
--config <path> 指定配置文件路径(默认 ~/.minidict.json)
-h, --help 显示帮助
-v, --version 显示版本
# 仅使用必应插件,并展示 2 条例句
dict "take off" --plugin bing --examples --max-examples 2
# 使用有道插件,显示音标
dict hello --plugin youdao --phonetic
# 从指定配置文件加载
dict hello --config /path/to/my-minidict.json
minidict 同时提供可编程接口(ESM):
import { translate } from 'minidict/dist/translate.js';
import type { Config } from 'minidict/dist/types.js';
const config: Config = {
plugins: ['bing', 'youdao'],
showPhonetic: true,
showExamples: true,
maxExamples: 3
};
const results = await translate('hello world', config);
// results: Array<{
// word: string;
// phonetic?: string | { uk?: string; us?: string };
// translations: string[];
// examples?: Array<{ en: string; zh: string }>;
// pluginName: 'Bing' | 'Youdao';
// }>
src/plugins/minidict-<name>/translate(word): Promise<TranslationResult>cheerio 解析 + 多选择器回退TranslationResultminidict-bing: 解析 cn.bing.com/dict 页面并支持短语接口 ttranslatev3minidict-youdao: 解析 dict.youdao.com 页面并支持 JSON 接口config.maxExamples 限制--plugin youdao 或 --plugin bingplugins: ["bing"] 或在命令行加 --plugin bingshowPhonetic: false 或命令行不加 --phoneticmaxExamples 或命令行 --max-examples <num># 安装依赖
yarn install
# 开发编译(watch 模式)
yarn dev
# 运行测试
yarn test
# 构建
yarn build
# 代码检查
yarn lint
prepublishOnly 会触发 yarn buildnpm pack --dry-run 确认发布包内容MIT
FAQs
The npm package minidict receives a total of 46 weekly downloads. As such, minidict popularity was classified as not popular.
We found that minidict demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.