
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pipe-and-compose-types
Advanced tools
This package strictly contains types. The star of this package is a recursive Pipe type with surprising utility over parameter overloading. These benefits include
Pipe and ComposeIt's biggest weakness is still stronger than the parameter overloading approach, namely generics on compose functions are not preserved; however, it will accept them and the resulting type will be {}. The overloading approach can actually often fail to compile in those situations.
The main benefit of the overloading approach to this recursive type is that when error occur, the compiler is better able to explain where the error occurred. With this type, in the event of a compile error, the returned type will itself contain information on what went wrong.
Key exported types include
Pipe as mentioned aboveCompose data flows from bottom up ( or left to right )PipeFn Pipe applied to create a reference function typeComposeFn Compose applied to create a reference function typePipelineFn Pipe applied to create a useful pipeline function typeOther types exported
ExtractFunctionArguments extracts function argumentsExtractFunctionReturnValue extracts a functions return typeAd-hoc types that may aid in constructing applications from these types.
AnyFunction a type representing any kind of function, an alternative to FunctionAnyFunction1 a function representing any function with an arity of 1npm install pipe-and-compose-types
Example:
import { PipeFn } from 'pipe-and-compose-types'
declare const example: ( first: number, rest: number[] ) => number
declare const pipe: PipeFn
const result = pipe(
example,
String
) // (first: number, rest: number[]) => string
Read more at https://dev.to/babak/introducing-the-recursive-pipe-and-compose-types-3g9o
FAQs
Powerful Typescript types for `pipe` and `compose`
We found that pipe-and-compose-types demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.