
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
poliscore-node
Advanced tools
A Polis full node for building applications and services with Node.js. A node is extensible and can be configured to run additional services. At the minimum a node has an interface to Polis Core with additional indexing for more advanced address queries. Additional services can be enabled to make a node more useful such as exposing new APIs, running a block explorer and wallet service.
npm install -g poliscore-node
poliscore-node start
Note: For your convenience, we distribute polisd binaries for x86_64 Linux and x86_64 Mac OS X. Upon npm install, the binaries for your platform will be downloaded. For more detailed installation instructions, or if you want to compile the project yourself, then please see the Bitcore branch of Polis Core with additional indexing.
Bitcore includes a Command Line Interface (CLI) for managing, configuring and interfacing with your Bitcore Node.
poliscore-node create -d <polis-data-dir> mynode
cd mynode
poliscore-node install <service>
poliscore-node install https://github.com/yourname/helloworld
This will create a directory with configuration files for your node and install the necessary dependencies. For more information about (and developing) services, please see the Service Documentation.
There are several add-on services available to extend the functionality of Bitcore:
Please send pull requests for bug fixes, code optimization, and ideas for improvement. For more information on how to contribute, please refer to our CONTRIBUTING file.
Code released under the MIT license.
Copyright 2013-2015 BitPay, Inc.
FAQs
Full node with extended capabilities using Bitcore and Polis Core
We found that poliscore-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.