
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Cradlepoint NCM APIv2 package
Created by: Jon Gaudu
Ported from: https://pypi.org/project/ncm/
Overview: The purpose of this package is to make it easier for users to interact with the Cradlepoint NCM APIv2. Within this package is a set of methods that closely match the available API calls. Full documentation of the Cradlepoint NCM API is available at https://developer.cradlepoint.com.
Requirements: A set of Cradlepoint NCM APIv2 keys are required to make API calls. While the class can be instantiated without supplying API keys, any subsequent calls will fail unless the keys are set via the set_api_keys() method.
Usage examples:
const NcmClient = require('ncmapiv2');
async function main() {
const client = new NcmClient({
'X-CP-API-ID': 'your',
'X-CP-API-KEY': 'api',
'X-ECM-API-ID': 'keys',
'X-ECM-API-KEY': 'here'
});
// get accounts
const accounts = await client.getAccounts()
console.log(accounts);
// update configuration manager
const configManagerId = 1234567
const configUpdate = {"configuration": [{"system": {"system_id": "updated-system-id"}}, [] ]}
const updatedConfigManager = await client.updateConfigurationManagers(configManagerId, configUpdate);
console.log(updatedConfigManager);
}
Tips: This package includes a few optimizations to make it easier to work with the NCM APIv2. The default record limit is set at 500 instead of the Cradlepoint default of 20, which reduces the number of API calls required to return large sets of data. This can be modified by specifying a limit parameter:
const accounts = await client.getAccounts({ limit: 10 });
You can also return the full list of records in a single array without the need for paging by passing { limit: 'all' }:
const accounts = await client.getAccounts({ limit: 'all' });
It also has native support for handling any number of "__in" filters beyond Cradlepoint's limit of 100. The script automatically chunks the list into groups of 100 and combines the results into a single array.
FAQs
NCM APIv2
We found that ncmapiv2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.