
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pacproxy-js
Advanced tools
A https proxy server which supports websocket and CDN. 支持websocket和CDN中转的加密代理服务器
推荐用pacproxy安全的访问以下网站:
运行pacproxy服务后,屏幕会显示 pacurl 和 wssurl
用pacurl翻墙请参照 pac代理电脑手机设置
用wssurl翻墙请参照 wssagent代理软件
搭建pacproxy服务器需要申请一个域名
参见 pacproxy服务器
一般直接运行一个不加密的pacproxy服务,再用nginx或LiteSpeed Web Server反向代理成加密服务, 支持websocket代理
可以直接在代码里编辑pacproxy.js里的configsInCode部分,也可以单独保存网站设置文件,参见示例设置
node runproxy.js [网站配置文件] [监听端口号]
如:node runproxy.js ./example.site.domain/production.cfg 3129
其中[网站配置文件] [监听端口号] 均为可选参数
sudo pm2 start ./runproxy.js -- ./example.site.domain/production.cfg
pm2 start ./runproxy.js -- -- ./example.site.domain/production.cfg
nohup sudo ./runproxy.js ./example.site.domain/production.cfg &
FAQs
A https proxy server which supports websocket and CDN. 支持websocket和CDN中转的加密代理服务器
The npm package pacproxy-js receives a total of 7 weekly downloads. As such, pacproxy-js popularity was classified as not popular.
We found that pacproxy-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.