
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pinyin-fixed
Advanced tools
这是一款简单高效的拼音匹配引擎,它能使用拼音够快速的检索列表中的数据。
在线演示:https://aui.github.io/pinyin-engine/example/
npm install pinyin-fixed --save
建立拼音索引。
参数:
{[string]|[Object]} 被索引的目标{[string]} 可选。如果 list 为 Object,这里用来设置需要被索引的 key查询匹配拼音的数据。
参数:
{string} 拼音或者关键字返回:
{[string]|{Object}}
包含简体中文与繁体中文。
const PinyinEngine = require('pinyin-fixed/tw')
列表项为字符串:
const PinyinEngine = require('pinyin-fixed')
// 建立数据索引
const pinyinEngine = new PinyinEngine(['清华大学', '北京大学', '中央美院'])
// 查询
pinyinEngine.query('daxue') // ['清华大学', '北京大学']
列表项为对象:
const PinyinEngine = require('pinyin-fixed')
// 建立数据索引
const pinyinEngine = new PinyinEngine(
[{ id: 0, name: '清华大学' }, { id: 1, name: '北京大学' }, { id: 3, name: '中央美院' }],
['name']
)
// 查询
pinyinEngine.query('daxue') // ['清华大学', '北京大学']
##重要
这个包是搬运来自 pinyin-engine
因为有一个首字母如果大写不匹配的 bug 和繁体版本引入 bug,所以做了一点微小的更正,原则上只是方面自己使用的版本,请大家支持原作者aui,谢谢开源社区
FAQs
JavaScript拼音匹配
We found that pinyin-fixed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.