
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
the easy way to parse a feed/rss with promise/async function, powers by feedparser
npm i parsefeed
const { parseFeed } = require("parsefeed");
parseFeed("http://example.com/feed").then((items) => {
for (const item of items) {
console.log(item.title);
console.log(item.meta);
}
});
(async () => {
const items = await parseFeed("http://example.com/feed");
for (const item of items) {
console.log(item.title);
console.log(item.meta);
}
})()
title
description (frequently, the full article content)
summary (frequently, an excerpt of the article content)
link
origlink (when FeedBurner or Pheedo puts a special tracking url in the link property, origlink contains the original link)
permalink (when an RSS feed has a guid field and the isPermalink attribute is not set to false, permalink contains the value of guid)
date (most recent update)
pubdate (original published date)
author
guid (a unique identifier for the article)
comments (a link to the article's comments section)
image (an Object containing url and title properties)
categories (an Array of Strings)
source (an Object containing url and title properties pointing to the original source for an article; see the RSS Spec for an explanation of this element)
enclosures (an Array of Objects, each representing a podcast or other enclosure and having a url property and possibly type and length properties)
meta (an Object containing all the feed meta properties; especially handy when using the EventEmitter interface to listen to article emissions)
titledescriptionlink (website link)xmlurl (the canonical link to the feed, as specified by the feed)date (most recent update)pubdate (original published date)authorlanguageimage (an Object containing url and title properties)favicon (a link to the favicon -- only provided by Atom feeds)copyrightgeneratorcategories (an Array of Strings)(refer: feedparser's document)
FAQs
the easy way to parse a feed/rss with promise/async function
We found that parsefeed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.