
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
misvarvi, Estonian for "What color?", is a command-line tool that finds the closest color in color-name-list to the color that was passed in, using the CIEDE2000 color difference algorithm. It was inspired by cherangi but was designed for command-line use, so it emits a well-formed JSON object instead of a debug object, and was also switched to use the CIEDE2000 algorithm instead of the CIE94 algorithm, as it's more accurate.
npm install --global misvarvi
Hex colors, CSS HSL, and CSS RGB are accepted, among a few other less useful forms. (See the chromatism docs for all valid forms.)
misvarvi '#AE3440'
It will return a JSON object, which you can then parse using something like jq.
{"delta":1.4980639388194081,"status":4,"hex":"#a73940","name":"Jules"}
The JSON object will always have the following values:
null if no match was found.Status will be one of the following numbers:
They are bitflags because cherangi used bitflags, not because they will ever be returned OR'd together. They could've easily been 0, 1, 2, 3, 4, 5, and 6, but I already have scripts designed for cherangi and didn't want to change them.
FAQs
A command-line tool to name colors using CIEDE2000, inspired by cherangi
We found that misvarvi demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.