
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A web interface for pass (password-store).
For those lucky enough to run Arch Linux, you should install it from AUR
For other, you can install it via npm:
$ npm install -g pass-web
You will need nodejs 5+ to run it.
The executable is called pass-web. Use pass-web --help to get help.
You should always use HTTPS to serve this application. Please use the --cert and --key options
to provide an SSL certificate and key, or use another HTTP server (like nginx) configured to serve
this through an HTTPS-enabled reverse proxy.
For a preview of the interface you'll get when using this project, go to https://benoitzugmeyer.github.io/pass-web/
This is currently a read-only interface, and there is no plan to support all the features of pass. The goal was to have a nice and simple access to the password store from anywhere. But if you need other features, feel free to ask or contribute.
This project may have some security flaws. Please open an issue if something's fucky.
FAQs
A web interface for pass (password-store)
We found that pass-web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.