
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
rock.so-sdk
Advanced tools
import { RockAPi } from 'rock.so-sdk'
const rockApi = new RockApi(process.env.ROCK_BOT_TOKEN)
rockApi.sendMessage('Hello!')
All methods available on Rock.so Public Api are available on the SDK, i.e.:
| Method | Description |
|---|---|
| sendMessage | The sendMessage method allows you to send a new message. |
| createNote | Create note. |
| createTask | Create a new task. |
| getBotInfo | Allows you to retrieve basic information about the public API bot. |
| getCustomFields | Allows you to retrieve information about custom fields defined for the tasks in bot’s space. |
| getTaskLists | Allows you to retrieve information about tasks lists defined in the bot’s space. |
| listLabels | The listLabels method can be used to retrieve the list of labels assigned to tasks. Note that labels are created and deleted "on the fly"; when there are no more tasks with a given label (either the label was removed from all tasks, or all tasks with the label were deleted), that label is deleted. |
| listSpaceMembers | The listSpaceMembers method can be used to retrieve a list of space members, including both people and bots. |
| listSprints | The listSprints method can be used to retrieve a list of sprints defined in the space. |
await rockApi.sendMessage('Hello')
await rockApi.createNote({
body: [{ text: "hello world" }],
labels: ["label"], //Optional
watchersIds: ["abcd123"], //Optional
});
import { ListIdStatusEnum, PriorityEnum } from "rock.so-sdk";
await rockApi.createTask({
body: [{ text: "hello world" }],
listId: ListIdStatusEnum.TO_DO,
priority: PriorityEnum.HIGH,
title: "hello world",
start: 123456789, //Optional
due: 123456789, //Optional
owners: ["abcd123"], //Optional
checkList: ["abcd123"], //Optional
severity: 1, //Optional
sprint: 1, //Optional
customFields: ["abcd123"], //Optional
labels: ["abcd123"], //Optional
recurringSchedule: { //Optional
dayOfMonth: 1,
daysOfWeek: {
monday: true,
tuesday: true,
wednesday: true,
thursday: true,
friday: true,
saturday: true,
sunday: true,
},
targetListId: "abcd123",
type: 1,
workdaysOnly: true,
},
watchersIds: ["abcd123"], //Optional,
});
const { data } = await rockApi.getBotInfo();
const { data } = await rockApi.getCustomFields();
const { data } = await rockApi.getTaskLists();
const { data } = await rockApi.listLabels();
const { data } = await rockApi.listSpaceMembers();
const { data } = await rockApi.listSprints();
FAQs
## BASIC USAGE
We found that rock.so-sdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.