
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
mongo-date-query
Advanced tools
Mongo date query helper for common queries
Builds query objects for commonly used mongo date queries. Helpful in generating data for tables, graphs, and charts.
Works with both mongoose and mongodb. All dates are in UTC.
$ npm install mongo-date-query
import mdq from "mongo-date-query";
const mdq = require("mongo-date-query");
import mdq from "mongo-date-query";
//mongoose
User.find({ createdAt: mdq.lastWeek() }, function (err, users) {
if (!err) {
console.log(users);
}
});
//mongodb
const collection = db.collection("users");
collection.find({ createdAt: mdq.yesterday() }).toArray(function (err, users) {
if (!err) {
console.log(users);
}
});
General pattern:
this: Start and end of a time unit [thisHour(), thisYear() etc.]
next: From now [nextMonth() = month from now]
last: Before now [lastYear() = year before now]
coming: The current given unit is not included [comingYear() = year after (not including) this year]
previous: The current given unit is not included [previousMonth() = month before (not including) this month]
before: Before the given unit [beforePreviousMonth(), beforeLastMinute()]
after: After the given unit [afterThisWeek(), afterNextMonth(), afterComingYear()]
lastToNext: From last time unit to next [lastToNextMinute() = from last minute to next minute, lastToNextDay() = from last 24 hours to next 24 hours]
APIs with plural version: Takes a Number parameter. Default is 1. [nextMonths(2), comingYears(3), lastWeeks(4), beforePreviousMonths(3), afterComingYears(5) lastToNextDays(3, 4)]
MIT © Talha Awan
FAQs
Mongo date query helper for common queries
The npm package mongo-date-query receives a total of 74 weekly downloads. As such, mongo-date-query popularity was classified as not popular.
We found that mongo-date-query demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.