
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
super simple and small cross-browser XMLHttpRequest (XHR)
var minixhr = require('minixhr')
function response (error, data, header) {
if (error) return console.error(error)
console.log(data)
console.log(header)
}
const string = JSON.stringify({ foo: 123, bar: "abc" }) // payload
const URL1 = 'https://jsonplaceholder.typicode.com/posts/1'
// @NOTE check http://requestb.in/18b4srl1?inspect after a request to inspect server
const URL2 = 'http://requestb.in/18b4srl1' // make a `http://requestb.in` to get your own
var request1 = URL1
var request2 = { // can be 'url string' or object:
/*required*/url : URL2,
/*optional*/method : 'POST', // (defaults to `GET`)
// can be any http method like `['GET', 'POST', 'HEAD', 'PUT', ...]` or `'JSONP'`
/*optional*/data : string, // (defaults to: `undefined`)
// can be any string, maybe formatted as e.g. <FORMDATA> or JSON e.g. '{"key":"val"}'
// if set and no method provided, method will be set to 'POST'
/*optional*/headers : {}, // (defaults to `{}`)
// in case of `method === 'POST'` it defaults to:
// {'X-Requested-With':'XMLHttpRequest','Content-Type':'application/x-www-form-urlencoded' }
/*optional*/timeout : 1000, // (defaults to `0`, wich means NO timeout)
// can be any number of miliseconds, or "sync" (to make a synchronous request)
}
// EXAMPLE 1
minixhr(/*required*/request1, /*optional*/response)
// EXAMPLE 2
minixhr(/*required*/request2)
if you need to support old browsers, use version 3.1.0 or below.
Those versions still include the xhr polyfill
FAQs
super simpel and small cross-browser xhr
The npm package minixhr receives a total of 8,992 weekly downloads. As such, minixhr popularity was classified as popular.
We found that minixhr demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.

Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.