
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A CLI tool to generate OpenAPI schema from Next.js routes. It analyzes your Next.js API routes and automatically generates comprehensive OpenAPI 3.0 specifications, including schemas for request/response models, enums, and more.
Install globally via npm:
npm install -g next-oapi
Or using pnpm:
pnpm add -g next-oapi
Or using bun:
bun add -g next-oapi
After installation, you can use the CLI in your Next.js project directory:
next-oapi --project <path-to-next-project>
For example:
next-oapi --project . --out ./custom-docs
This will generate an openapi.json file in the specified output directory (or the default src/docs/ or docs/ folder).
--project <path>: Path to the Next.js project directory (required)--out <path>: Output directory for the generated openapi.json (optional, defaults to src/docs/ or docs/)--help: Show help messageThe tool generates a complete OpenAPI 3.0 specification that includes:
⚠️ Important: This tool is designed to analyze pure Next.js API routes only. It does not support (and may produce incorrect or incomplete results for):
For custom authentication, data validation, or RPC patterns, please use targeted libraries designed for those systems.
pnpm install
pnpm run test
pnpm run build
pnpm run dev
pnpm run build: Build the CLI tool with tsdownpnpm run dev: Watch mode for developmentpnpm run test: Run unit tests with Vitestpnpm run typecheck: Type-check the TypeScript codepnpm run release: Bump version and publish to npmMIT
FAQs
CLI tool to generate OpenAPI schema from Next.js routes
We found that next-oapi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.