
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
nodestream-filesystem
Advanced tools
nodestream-filesystemLocal filesystem adapter for Nodestream
Identity: filesystem
This adapter provides interface for Nodestream to transfer bytes between your app and the local filesystem storage on which the app runs.
npm install --save nodestream-filesystem
This adapter has only one confuguration option - root - a path to a folder where Nodestream should expect to find/write your files to. If you do not provide this option, then Nodestream will try its best to determine that path for you:
require.main and using itIn all these default cases, the target folder will be named .storage. If it does not exist, it will be created on first write.
Even with these defaults, you should always explicitly state where Nodestream should put your files. It's the only way to guarantee that you will not spend hours searching through your project's files trying to figure out where the hell did that file go. 😀
const Nodestream = require('nodestream')
const nodestream = new Nodestream({
adapter: 'filesystem',
config: {
// You MUST provide either an absolute path or nothing at all
// You can use array notation, the parts will be `path.join()`ed for you
root: [__dirname, '.storage']
}
})
This software is licensed under the BSD-3-Clause License. See the LICENSE file for more information.
FAQs
Local filesystem adapter for Nodestream
We found that nodestream-filesystem demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.