
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A tiny, super fast, stream based replacement template engine written in typescript. Now recursive! (keep reading to learn what that means)
This module has few features.
Simply use your package manager of choice.
npm i --save procuratoryarn add procuratorprocurator(parameters[, recursive = true, limit = 100])
Code speaks. Let's do this.
some.template.js
module.exports = {
// Simple replace
hello: '{{ foo }}',
// With a default
cake: '{{ bar : lies }}',
// Defaults get trimmed, let's use quotes
bacon: '{{ bat : ' holds the truth ' }}',
// Let's use double quotes
empire: '{{ baz:"I haz\'s one" }}',
// Let's default to an empty string
hello: '{{ foo: }}',
// Whaaaaaat, nested keys!?
username: '{{ user.name:"Guest" }}',
};
app.js
const { stream } = require('procurator');
const fs = require('fs');
let readStream = fs.createReadStream('./some.template.js');
let writeStream = fs.createWriteStream('./out-file.js');
let parameters = {foo: 'Batman', bat: 'is holy', user: {name: 'Swag-meister'}};
let recursive = true; // New: replace more than once to allow for nested variables
let limit = 100; // New: the maximum replacement depth. Throws an Error when reached.
readStream.pipe(stream(parameters, recursive, limit)).pipe(writeStream);
Produces ./out-file.js:
module.exports = {
// Simple replace
hello: 'Batman',
// With a default
cake: 'lies',
// Defaults get trimmed, let's use quotes
bacon: 'is holy',
// Let's use double quotes
empire: 'I haz one',
};
Note: The file extension doesn't matter. I used .js but it can be anything.
procurator(target, parameters[, recursive = true, limit = 100])`
Sometimes you just want to apply replaces in memory. For that purpose, a memory and code-size efficient method has been added.
const procurator = require('procurator');
const target = 'Hello {{addressed: "world"}}! How are you doing {{ when: "today"}}?';
const recursive = true; // New: replace more than once to allow for nested variables
const limit = 100; // New: the maximum replacement depth. Throws an Error when reached.
console.log(procurator.replace(target, {addressed: 'developer'}, recursive, limit));
// Outputs: Hello developer! How are you doing today?
As of v2.0.0, Procurator supports nested placeholders. This means you can do the following (using sync for simplicity):
const procurator = require('procurator');
const target = 'Hello {{addressed: "{{title: "Mr."}} world"}}! How are you doing {{ when: "today" }}?';
const recursive = true; // New: replace more than once to allow for nested variables
const limit = 100; // New: the maximum replacement depth. Throws an Error when reached.
console.log(procurator.replace(target, {title: 'Mrs.'}, recursive, limit));
// Outputs: Hello Mrs. world! How are you doing today?
This also works for parameters themselves; meaning that you can replace placeholders with strings that also contain placeholders.
It's currently not possible to spread a placeholder over multiple lines. If you have a use case for this please create an issue.
MIT
FAQs
A tiny, stream based replacement template engine.
We found that procurator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.