
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
蘑菇视频 API 接口
npm install mogu-api
按需导入您需要的功能:
import {
getVideoInfo,
getHlsText,
parseHlsURL,
getAESConfig,
loadVideo,
getVideoSearchResult,
getAllLabels,
getVideoTypeMenu,
getVideoListByType,
downloadFile
} from 'mogu-api'
getVideoInfo: (videoId: number | string) => Promise
获取视频信息,返回视频标题、视频播放地址等
getHlsText: (videoUrl: string, videoId: number | string) => Promise
获取视频 M3U8 字符串,输入加密的 M3U8 地址,解密并输出 M3U8 内容
parseHlsURL: (videoUrl: string, videoId: number | string) => Promise
解密视频地址并返回可播放的 Hls URL,输入加密的 M3U8 地址,输出可直接播放的 Hls 地址
getAESConfig: (videoId: number | string) => { key: lib.WordArray, iv: lib.WordArray }
获取 AES 配置信息,返回解密时需要的密钥和偏移量
loadVideo: (videoId: number | string, element: HTMLMediaElement) => Promise
将视频载入到视频元素,根据视频 ID 获得解密后的 M3U8 字符串,创建 ObjectURL 对象,然后通过 Hls 将视频载入到视频元素中
getVideoSearchResult: (keyword: string, page?: number, pageSize?: number) => Promise<VideoListItem[]>
获取视频搜索结果
getAllLabels: () => Promise<{ id: number, name: string }[]>
获取所有的标签
getVideoTypeMenu: () => Promise
获取视频分类菜单
getVideoListByType: (typeIds: number[], options?: { page?: number, pageSize?: number, order?: 'stat' | 'view' | 'id' }) => Promise<VideoListItem[]>
获取分类视频列表
downloadFile: (objectURL: string, filename: string) => void
下载文件
getImageBase64Src: (imageUrl: string) => Promise
将图片转换为 Base64 格式,返回值可直接设置为图片元素的 src 属性
FAQs
蘑菇视频 API 接口
We found that mogu-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.