
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Command-line interface for Radio4000
npm i -g r4
r4 help
Here's a quick overview:
r4 channel list --limit 10
r4 channel view ko002
r4 track list --channel ko002
r4 track list --channel ko002 --tag jazz,ambient
r4 download ko002 # downloads to ./ko002/
r4 download ko002 --base-url https://cdn.example.com # absolute URLs in download.json
r4 download ko002 --backup-file # only write download.json, no download
r4 search "ambient"
r4 auth login
r4 channel create radio123 --name "Radio 123"
r4 track create --channel radio123 --title "Song" --url "https://youtube.com/..."
r4 track update <id> --title "Updated song"
# Pipe and compose
r4 track list --channel ko002 --limit 10 | jq '.[] | .title'
# Or export to sqlite
r4 schema | sqlite3 my.db
r4 track list --channel ko002 --format sql | sqlite3 my.db
Most commands support a --format flag to print human-readable text, json or SQL.
For the
r4 downloadcommand to work, make sureyt-dlpis installed.
After downloading, a download.json is written alongside the tracks — a self-contained ChannelBackup ({ version, created_at, channel, tracks[] }) where each track's url points to its local file at tracks/<filename>.<ext>. Tracks that failed to download keep their original remote URL. Use --base-url to produce absolute URLs (e.g. when serving the folder over HTTP). Use --no-metadata to skip writing download.json.
git clone git@github.com:radio4000/cli.git
cd r4
bun install
bun link # optional for easy local dev
bun run check # format and lint
bun run test
FAQs
CLI for Radio4000
We found that r4 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.