
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
postgres-dump-converter
Advanced tools
The module is able to convert a file containging multiple INSERT statements of one row to one INSERT statement with multiple rows
I create this script to help me convert a postgres dump form having multiple INSERT statements for one table to have one INSERT statements of more rows per each table. You can achieve the same result by using pg_dump with the following parameters: --inserts --row-per-insert=NNN (NNN = number of rows per INSERT)
This script reads in a text file containing SQL INSERT INTO statements and converts them into a single multiple rows INSERT INTO statement for each table.
INSERT INTO keyword.INSERT INTO keyword, it extracts the table name from the line and adds it to an object that holds the insert statements for each table.INSERT INTO keyword, it prints the line as is.INSERT INTO statement for each table by joining the array of insert statements for the table with commas.Input:
INSERT INTO table1 (col1, col2) VALUES (1, 'a');
INSERT INTO table1 (col1, col2) VALUES (2, 'b');
INSERT INTO table2 (col1, col2) VALUES (3, 'c');
Output:
INSERT INTO table1 (col1, col2) VALUES (1, 'a'), (2, 'b');
INSERT INTO table2 (col1, col2) VALUES (3, 'c');
To use this script, replace the test/inputFile argument in the fs.readFile function with the path to your input file and run the script using Node.js.
node script.js > test/outputFile
The script and the readme page was created using chat.openai.com
FAQs
The module is able to convert a file containging multiple INSERT statements of one row to one INSERT statement with multiple rows
We found that postgres-dump-converter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.