
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
object-layout
Advanced tools
force a specific object layout in node
By taking advantage of the fact that most javascript engines layout objects such that the properties exist in the order they are created.
Thats easy - just npm install object-layout.
Pass an un-layed-out object and a schema:
var objectLayout = require('object-layout');
// will result in {one: 1, two: 2, three: 3, four: 4}
objectLayout({
one: 1,
four: 4,
two: 2,
three: 3
}, {
one: true,
two: true,
three: true,
four: true
});
Pass a schema to create a layout function:
var objectLayout = require('object-layout');
var fn = objectLayout({
one: true,
two: true,
three: true,
four: true
});
// will result in {one: 1, two: 2, three: 3, four: 4}
fn({
one: 1,
four: 4,
two: 2,
three: 3
});
Ignore fields unreferenced by the schema (default):
var objectLayout = require('object-layout');
// will result in {one: 1, two: 2, three: 3, four: 4}
objectLayout({
one: 1,
four: 4,
two: 2,
three: 3,
ten: 10
}, {
one: true,
two: true,
three: true,
four: true
});
Append fields unreferenced by the schema:
var objectLayout = require('object-layout');
// will result in {one: 1, two: 2, three: 3, four: 4, ten: 10}
objectLayout.append({
one: 1,
four: 4,
two: 2,
three: 3,
ten: 10
}, {
one: true,
two: true,
three: true,
four: true
});
See more in the tests.
MIT
FAQs
force a specific object layout in node
We found that object-layout demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.