
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Cart Widget that can be embedded into sites in order to allow its users to buy products and send orders to the site owner.
Step by step explanation how project has been built.
There's a git tag for every step, use it to see state of project for every step - type
git checkout <tag-name> and git checkout master to set project to the latest state.
html-mockups.We need it to use LESS, and as our web server.
Don't use NodeJS pre-packaged installer because it will install it with sudo and
you don't want that, also don't install it via brew or other package manager because
for some reason unknown to me all of them install it somehow wrongly.
It's better to built NodeJS from sources.
wget http://nodejs.org/dist/vX.X.X/node-vX.X.X.tar.gz
tar -xzf node-vX.X.X.tar.gz
cd node-vX.X.X
./configure
make
make install
NodeJS should be installed, then type npm install less -g
Download Twitter Bootstrap http://getbootstrap.com, go to css folder, create
bootstrap.less file and copy content of bootstrap.css there (LESS is superset of CSS so it will be fine).
Create file bootstrap-widget.less and put import bootstrap styles into namespace.
.bootstrap {@import "./bootstrap.less";}
Now run LESS and convert it to CSS
lessc bootstrap-widget.less > bootstrap-widget.css
You should get file bootstrap-widget.css with all bootstrap styles put under
the bootstrap namespace.
Copyright (c) Alexey Petrushin, http://petrush.in, released under the MIT license.
FAQs
Cart Widget turning any Site into Shop
The npm package sales receives a total of 7 weekly downloads. As such, sales popularity was classified as not popular.
We found that sales demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.