
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
mobile-device
Advanced tools
Detection of mobile devices based on user-agent
$ npm install mobile-device
const isMobileDevice = require("mobile-device");
// isMobileDevice => true
const ipadUserAgent = 'Mozilla/5.0 (iPad; CPU OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1';
const iphoneUserAgent = 'Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148';
const androidTabletUserAgent = 'Mozilla/5.0 (Linux; Android 7.1.1; SM-T555 Build/NMF26X; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.96 Safari/537.36';
const androidPhoneUserAgent = 'Mozilla/5.0 (Linux; Android 6.0.1; RedMi Note 5 Build/RB3N5C; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/68.0.3440.91 Mobile Safari/537.36';
// isMobileDevice => false
const windowsDesktopChrome = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36';
const linuxDesktopFirefox = 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0';
const macDesktopSafari = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15';
console.log(`ipadUserAgent: ${isMobileDevice(ipadUserAgent)}`);
console.log(`iphoneUserAgent: ${isMobileDevice(iphoneUserAgent)}`);
console.log(`androidTabletUserAgent: ${isMobileDevice(androidTabletUserAgent)}`);
console.log(`androidPhoneUserAgent: ${isMobileDevice(androidPhoneUserAgent)}`);
console.log(`windowsDesktopChrome: ${isMobileDevice(windowsDesktopChrome)}`);
console.log(`linuxDesktopFirefox: ${isMobileDevice(linuxDesktopFirefox)}`);
console.log(`macDesktopSafari: ${isMobileDevice(macDesktopSafari)}`);
/*
ipadUserAgent: true
iphoneUserAgent: true
androidTabletUserAgent: true
androidPhoneUserAgent: true
windowsDesktopChrome: false
linuxDesktopFirefox: false
macDesktopSafari: false
*/
MIT license; see LICENSE.
FAQs
Detection of mobile devices based on user-agent
We found that mobile-device demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.