
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
=====
NodeJS Note tracker command line utility inspired by Rails Rake Notes
Notey is a nodejs command line utility inspired by the notes rake task available for Rails. It retrieves all properly formatted notes from a directory / directories no matter how many levels deep. See a list of currently supported note formats.
$ npm install -g notey
Notey now supports color with version 0.0.6!
Green for line numbers - Line 8
Yellow for TODOs - TODO
Cyan for OPTIMIZEs - OPTIMIZE
Red for FIXMEs - FIXME
Notey accepts an infinite number of directories & files to look inside. When called by itself with no arguments, it will default to the current working directory.
For example specifying the multiple directories:
$ notey my_dir another_dir
# output:
my_dir/core.scss:
* [Line 1] [TODO] add more fonts
* [Line 5] [TODO] remove font below
another_dir/stuff.js:
* [Line 4] [TODO] rename module
* [Line 12] [TODO] refactor
* [Line 23] [TODO] include new algorithm
another_dir/things.go
* [Line 134] [TODO] remove unused struct
Or not specifying any directories
$ notey
# output:
User/person/dev/project/src/app/app.js:
* [Line 4] [TODO] update routes
* [Line 13] [TODO] add headers for CORS
* [Line 28] [TODO] update resolves
* [Line 39] [TODO] change fallback url
User/person/dev/project/src/app/controllers/main-controller.js:
* [Line 14] [TODO] make var more descriptive
User/person/dev/project/src/app/controllers/main-controller.spec.js:
* [Line 5] [TODO] remove hard-coded value
* [Line 33] [TODO] make expectation more dynamic
Warning: Only notes w/ a trailing ':' will be considered valid.
Note: For all languages especially non-listed ones, single line comments for notes are highly recommended.
Examples:
bad
// todo: this is bad
// Todo: this is bad
// ToDo: this is bad
// todo this is bad
// TODO this is bad
// fixme: this is bad
// Fixme: this is bad
// FixMe: this is bad
// fixme this is bad
// FIXME this is bad
// optimize: this is bad
// Optimize: this is bad
// OptiMize: this is bad
// optimize this is bad
// OPTIMIZE this is bad
good
// TODO: abstract into function
// FIXME: change type
// OPTIMIZE: sorting algorithm
/**
* TODO: change to camelCase
*/
<!-- FIXME: add href -->
/* OPTIMIZE: things */
Notey is tested using Mocha and ShouldJS
$ mocha
FAQs
Note tracker command line utility inspired by Rails Rake Notes
We found that notey demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.