
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ricks-bricks
Advanced tools
Run if happened X times within X ms and hasn't been run in X ms
Simply put it's yet another throttling utility. Specifically, I made to restart a server process if ECONNREFUSED is encountered by the reverse proxy beyond the threshold. It has plenty of other potential uses, but more than anything I wanted the logic isolated and reusable. So here it is in module form.
Run if happened X times within X seconds(ms, actually) and hasn't been run in X seconds(ms)
-> rihxtwxsahbrixs
-> rix-twix-sabrixs
-> ricks-bricks
$ npm install --save ricks-bricks
const rb = require('ricks-bricks')
const someCb = () => console.log('oak yeah')
// set the threshold
const rbOpts = { threshold: 3 }
// call with sig 2 times, 1 less than threshold
rb('sig', someCb, rbOpts)
rb('sig', someCb, rbOpts)
// call with differentSig once, doesn't trigger callback
rb('differentSig', someCb, rbOpts)
// call with sig a third time, now meets threshold, executes callback
rb('sig', someCb, rbOpts)
const rb = require('ricks-bricks')
const ms = require('pico-ms')
const someCb = () => console.log('oak yeah')
const delay = async (d) => {
await new Promise((resolve, reject) => setTimeout(resolve, d))
}
// this time also we also set resetAfter
const rbOpts = { threshold: 3, resetAfter: ms('5sec') }
async function main () {
// call with sig 2 times, 1 less than threshold
rb('sig', someCb, rbOpts)
rb('sig', someCb, rbOpts)
// wait 7 seconds
await delay(ms('7sec'))
// call with sig 3rd time, outside resetAfter, doesn't trigger callback
rb('sig', someCb, rbOpts)
// now call again once, shouldn't meet threshold
rb('sig', someCb, rbOpts)
// now call again, should meet threshold and call
rb('sig', someCb, rbOpts)
}
main()
const rb = require('ricks-bricks')
const ms = require('pico-ms')
const someCb = () => console.log('oak yeah')
const delay = async (d) => {
await new Promise((resolve, reject) => setTimeout(resolve, d))
}
// this time also we also set throttle
const rbOpts = { threshold: 3, throttle: ms('5sec') }
async function main () {
// call with sig 3 times, should execute callback
rb('sig', someCb, rbOpts)
rb('sig', someCb, rbOpts)
rb('sig', someCb, rbOpts)
// call a 4th time and 5th time, it should not execute, end count should be 1
rb('sig', someCb, rbOpts)
rb('sig', someCb, rbOpts)
// wait 7 seconds
await delay(ms('7sec'))
// call again, should effectively be the 2nd call as far as count is concerned
rb('sig', someCb, rbOpts)
// and we call one last time, this should be 3 and trigger cb
rb('sig', someCb, rbOpts)
}
main()
rb(signature, callback, options)rb.cleanupInterval = msms millsecondsMIT © Andrew Carpenter
FAQs
Run cb if called X times within X ms and hasn't been run in X ms
We found that ricks-bricks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.