
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
proxy-router
Advanced tools
NodeJS dynamic router for http-proxy. Handle requests to Apache, Nginx, NodeJS, and other server on port 80.
Small proxy router to route all requests to port 80 by proxying to another hosts and ports. Run NodeJS, Apache, Nginx, etc together in single server.
Before installing Proxy Router, ensure you have NodeJS, NPM, and Forever installed in your machine.
Also if you registering NodeJS app to Proxy Router, be carefull since we using forever -w start YOURAPP.
So if your app doing grunt or any action that changing files during runtime inside your app folder, we will restart your app.
Add ignore list to file .foreverignore in your app folder to avoid forever watching your changed files during runtime.
Proxy Router currently supported on Mac and Linux machine (who have /etc/hosts file).
$ npm install -g proxy-router
Please note, you must always run the Proxy Router with root priverllage (sudo). We need it to edit the /etc/hosts file.
$ sudo proxy-router COMMAND
Available Commands
When registering hosts, you will be asked for few infos:
http or httpsdev.app.localnode-app.com. Default is localhost (127.0.0.1)--port=PORT.index.js--prod --safeExample
Add new host with NodeJS app.
macbook:test-app euser$ sudo proxy-router add
? Server Type: (Use arrow keys)
❯ ⦿ NodeJS
⦿ Apache, Nginx, Etc
? Protocol: (Use arrow keys)
❯ ⦿ http
⦿ https
? Host Name: test
? Target Host: (127.0.0.1)
? Port: (8001)
? Location: (/Users/euser/node-apps/test-app)
? Server Starter: (index.js)
? Additional Arguments. Separated by space. --dev --safe
After test host added, Proxy Router will also start the test-app including the arguments.
Start command will be forever -w start index.js --dev --safe --port=8001
FAQs
NodeJS dynamic router for http-proxy. Handle requests to Apache, Nginx, NodeJS, and other server on port 80.
We found that proxy-router demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.