
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Pipedream OAuth CLI — Give AI agents access to 2500+ APIs via dynamic OAuth
Agent: "I need Spotify access to manage your playlist"
↓
$ pdauth connect spotify
↓
🔗 https://pipedream.com/_static/connect.html?token=ctok_xxx&app=spotify
↓
User clicks → OAuth flow → Done
↓
Agent can now call Spotify tools via MCP
npm install -g pdauth
Get your credentials at https://pipedream.com/settings/api
pdauth config
Or set directly:
pdauth config --set clientId=YOUR_CLIENT_ID
pdauth config --set clientSecret=YOUR_CLIENT_SECRET
pdauth config --set projectId=YOUR_PROJECT_ID
# Generate link for Spotify
pdauth connect spotify
# Generate for a specific user
pdauth connect google_sheets --user pedro@example.com
# Copy to clipboard
pdauth connect slack --copy
# Show connected accounts
pdauth status
# Show all users
pdauth status --all
# JSON output for scripts
pdauth status --json
# List available tools for an app
pdauth tools slack
# Call a tool
pdauth call slack.send_message channel=general text="Hello from AI!"
# Call with JSON args
pdauth call notion.create_page --args '{"title": "New Page", "parent_id": "..."}'
| Command | Description |
|---|---|
pdauth config | Configure Pipedream credentials |
pdauth apps [--search <query>] | List available apps (2500+) |
pdauth app <slug> | Get info about an app |
pdauth connect <app> | Generate OAuth link |
pdauth status | List connected accounts |
pdauth disconnect <app> | Revoke app access |
pdauth tools <app> | List MCP tools for an app |
pdauth call <app.tool> | Invoke an MCP tool |
All commands support:
-u, --user <id> — Specify user ID (default: "default")-j, --json — Output as JSONpdauth connect <app> → generates a secure OAuth linkpdauth call or direct MCPPowered by Pipedream Connect — managed OAuth for 2500+ APIs.
This CLI is designed for AI agents to request and use OAuth access dynamically:
User: "Add this song to my Spotify playlist"
Agent: I need Spotify access. Here's a link to authorize:
https://pipedream.com/_static/connect.html?token=...
User: *clicks, authorizes*
Agent: *calls pdauth call spotify.add_to_playlist ...*
✓ Added "Song Name" to your playlist!
Instead of pdauth config, you can use environment variables:
export PIPEDREAM_CLIENT_ID=your_client_id
export PIPEDREAM_CLIENT_SECRET=your_client_secret
export PIPEDREAM_PROJECT_ID=your_project_id
export PIPEDREAM_ENVIRONMENT=development # or production
MIT © Versatly
FAQs
🔐 Pipedream OAuth CLI - Give AI agents access to 2500+ APIs via dynamic OAuth
The npm package pdauth receives a total of 5 weekly downloads. As such, pdauth popularity was classified as not popular.
We found that pdauth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.