
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
please-send-emails
Advanced tools
This parses the csv file and send emails like happy birthday or anniversary accordingly.
This parses the csv file and send emails like happy birthday or anniversary accordingly.
Make sure you have the following items setup on your system:
Currently following events and their templates are supported:
event: EVENT_TYPES.BIRTHDAY, template: happy-birthday.html
event: EVENT_TYPES.ANNIVERSARY, template: happy-anniversary.html
event: EVENT_TYPES.GIFT_SELECTION_BIRTHDAY, template: gift-selection-birthday.html
event: EVENT_TYPES.GIFT_SELECTION_ANNIVERSARY, template: gift-selection-anniversary.html
Take a clone of this repository:
git clone https://github.com/mukarramishaq/please-send-emails.git
Rename .env.sample file to .env and update the values to that of yours.
Install dependencies:
yarn install #or npm install
Run it to send today's pending emails:
yarn please-send-emails
Update Users in src/assets/csvs/users.csv
name full name in initial letters in capitalemail email address of the userbirth_date date of birth in yyyy-mm-dd format onlyjoining_date date of joining in yyyy-mm-dd format onlyUpdate email templates in src/assets/email-templates/ folder.
These are Handlebar templates. All the variables are in handlebars format. Update the content as you like. But if the updated template has new variables then you need to update its context object:
src/context.ts under object contextHandlers. In, this contextHandlers object, key is value from enum EVENT_TYPES and value is a function. Whatever this function will return will be used as context for the email template of that specific event.Following are the steps:
Add HTML template to src/assets/email-templates/ folder under some unique name
Register the event of this template in src/types.ts under EVENT_TYPES enum
Register this email template in src/emailTemplatesRegister.ts by adding a new object of TemplateRegistry.
Note: attachments in TemplateRegistery is an array of Attachment objects. And filename and path attributes of Attachment can use context data. So, we can dynamically decide what attachment to send with email.
Note: Every element which can use context data must use Handlebars notation to access the context attributes. e.g. "Happy {{whatTh}} Anniversary". Here whatTh will be an attribute of context object
src/context.ts under object contextHandlers. In, this contextHandlers object, key is value from enum EVENT_TYPES and value is a function. Whatever this function will return will be used as context for the email template of that specific event.This repository use nodemailer to send emails through SMTP transporter. Currently, this repository supports two types of authentication for SMTP:
Email Address and Password to authenticate. It is less secure and for gmail, you'll have to allow less secure apps beforehand.Client ID, Client Secret and Refresh Token to authenticateFollowing ENV variables are necessary irrespective of the authentication type:
SMTP_HOST e.g for gmail its value is smtp.gmail.com.SMTP_PORT e.g 465 for secure and 587 for not secure.SMTP_AUTH_TYPE It can have one of the following values:
LOGINOAUTH2SMTP_AUTH_USER this is an email address through this nodemailer will authenticate and send emailsNow if your authentication type is LOGIN, uncomment and update the values of the following ENV variables:
SMTP_AUTH_LOGIN_PASS This is password to email addressAnd if your authentication type is OAUTH2, uncomment and update the values of the following ENV variables:
SMTP_AUTH_OAUTH2_CLIENT_IDSMTP_AUTH_OAUTH2_CLIENT_SECRETSMTP_AUTH_OAUTH2_REFRESH_TOKENNow to configure the sender and recipients name and emails, uncomment and update the following ENV variables:
EMAIL_FROM i.e sender of this email notificationEMAIL_TO a comma-separated list of recipients emailsThere are two more optional variables EMAIL_CC and EMAIL_BCC to configure a list of recipients as CC or BCC. Both these variables accept a comma-separated list of emails.
FAQs
This parses the csv file and send emails like happy birthday or anniversary accordingly.
We found that please-send-emails demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.