
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Converting a string to a number using JavaScript's built-in parseInt or parseFloat functions may lead to silent failures. For example, invalid characters in the string may be silently ignored, or the resulting number may have less precision than the string representation. This might be fine for some applications, but in other cases an explicit error would be more useful.
With all functions provided by safenum, conversions succeed only when the entire string is consumed during parsing, and the resulting number can be represented exactly as a JavaScript number. If the string contains additional characters, or if the resulting number loses any precision, then conversion fails.
npm install safenum
import {parseSafeInt} from 'safenum';
let num1 = parseSafeInt('1337'); // num1 is set to 1337
let num2 = parseSafeInt('123.0'); // throws (didn't consume entire string)
let num3 = parseSafeInt('9007199254740992'); // throws (number is not a SAFE_INTEGER)
function parseSafeInt(rawNum: string): number
Parses the string rawNum as an integer number. If parsing consumes the entire string and the resulting value is a SAFE_INTEGER, then the number is returned, otherwise throws a RangeError. If rawNum is not a string, a TypeError is thrown.
function parseSafeFloat(rawNum: string): number
Parses the string rawNum as a floating point number. If parsing consumes the entire string and the resulting value can be represented with no loss of precision, then the number is returned, otherwise throws a RangeError. If rawNum is not a string, a TypeError is thrown.
function tryParseSafeInt(rawNum: string): number
Parses the string rawNum as an integer number. If parsing consumes the entire string and the resulting value is a SAFE_INTEGER, then the number is returned, otherwise returns undefined. Also returns undefined if rawNum is not a string.
function tryParseSafeFloat(rawNum: string): number
Parses the string rawNum as a floating point number. If parsing consumes the entire string and the resulting value can be represented with no loss of precision, then the number is returned, otherwise returns undefined. Also returns undefined if rawNum is not a string.
# build from TypeScript source
npm run build
# run unit tests
npm test
# run benchmarks
npm run bench
MIT License. Copyright (c) 2020 Troy Gerwien
FAQs
Safer replacements for JavaScript's parseInt and parseFloat functions
The npm package safenum receives a total of 189 weekly downloads. As such, safenum popularity was classified as not popular.
We found that safenum demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.