
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
rsync-watch
Advanced tools
This lib was created because I needed a small helper for continuous syncing files with a remote device, where remote connection could be defined in files per project.
# globally, so you can use it from console anytime
npm i -g rsync-watch
yarn global add rsync-watch
#locally, so you can use it in project deps
npm i rsync-watch
yarn add rsync-watch
Generate empty config file in current directory under the name rsync.config.js
rsync-watch -i
Start watching
rsync-watch
Pass custom config file
rsync-watch -c /home/user/custom.config.js
Config file looks like below:
NOTE: if you want to exclude whole directory tree you need to specify **/* after it's name
module.exports = {
source: 'source-directory', // relative to directory where config is placed
destination: '/home/user/', // destination directory on remote or local machine
glob: '**/*', // glob for files which should be synced
ignore: ['node_modules/**/*'], // array of string globs which exclude files/directories
ssh: 'user@host' // optional ssh user and host if you sync with remote location
};
Mostly I'm running it while being in same directory as config file, so there are possible bugs with wrong cwd in other cases. Also, for now it was tested only on macOS.
FAQs
Watch files and sync with remote
We found that rsync-watch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.