
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
retrospective
Advanced tools

A chaining library to work with retrospective functions (aka next-chain-style) and types.
Install from npm:
npm i retrospective
The workhorse function is reduceChain, which collapses the given retrospective chain into an underlying function that can be executed:
import reduceChain, { RetrospectiveChain } from "retrospective-chain"
type MyNumberTransformer = (x: number) => number
const chain: RetrospectiveChain<MyNumberTransformer> = [
(next: MyNumberTransformer, x: number) => next(x) + 1,
(next: MyNumberTransformer, x: number) => next(x) ** 2
]
const result = reduceChain(chain, x => x)(5) // 26
A retrospective function is a function which takes another function with an identical signature as itself (sans the parameter under discussion, i.e. the resultant type is non-recursive) as its first parameter:
export type RetrospectiveFunction<F extends (...args: any) => any> = (
next: F,
...x: Parameters<F>
) => ReturnType<F>;
This pattern is useful in situations where you're expecting to perform a homogeneously typed operation on some set of data multiple times, e.g. a series of transformations, point-free code, etc. As well, this pattern works very well with async promises.
Here's an example of how you might use it to perform a set of sequential transformations on a number:
type MyNumberTransformer = (x: number) => number
const chain: RetrospectiveChain<MyNumberTransformer> = [
(next: MyNumberTransformer, x: number) => next(x) + 1,
(next: MyNumberTransformer, x: number) => next(x) ** 2
]
The above sequence roughly corresponds to the function x ** 2 + 1, but it divides this operation into component pieces.
This abstraction becomes useful for series of complicated, potentially asynchronous actions where you want higher chain elements to potentially preclude lower chain elements (or run them multiple times, catch errors, etc.).
You can bypass the homogeneous type requirement by having each executor operate on a large pre-typed context space, and then collapse individual results at the end. This corresponds to the pipeline pattern.
Next-chain functions are nothing new - but since there are many conflicting variants, I'm using "retrospective chain" to specifically refer to the variant with the following attributes:
Retrospective chains are executed by first using the reduceChain utility - you also need to pass in the identity function corresponding to the type transformation you are using. Essentially, this is just the most internally-executed element and does not take in the next parameter:
type MyNumberTransformer = (x: number) => number
const chain: RetrospectiveChain<MyNumberTransformer> = [
(next: MyNumberTransformer, x: number) => next(x) + 1,
(next: MyNumberTransformer, x: number) => next(x) ** 2
]
const result = reduceChain(chain, x => x)(5) // 26
An interesting use-case is whereby individual executor functions call multiple instances of their next function: this creates branching trees of execution, where for the case of N executors calling their next functions M times, creates N ^ M unique branches.
This pattern is used for e.g. coordinating parallel asynchronous processing, perform graph search, backtracking methods, etc. If each executor layer memoizes itself, this pattern forms the basis of a very robust algorithmic engine.
This library is probably rather feature-complete, but feel free to open a PR if there's anything I missed.
FAQs
A utility library for retrospective functions and types.
We found that retrospective demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.