
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
scratch-site-api
Advanced tools
scratch-site-api is a full library for working with the Scratch website with Node.JS
login, take a username and password to loginsignOut, sign out and invalidate the current sessiongetSession, get information about a sessionchangeCountry, change account country (Can be any valid country, first letter must be capitalized)changePassword, change account password, takes the old account password and the new passwordchangeEmail, change account email, takes the account password and new emailmessages.getMessages, get account messages, takes an offset and limitmessages.getCount, get account message countprofile.toggleComments, toggle commenting on user profileprofile.setStatus, takes a string to set user's WIWO toprofile.setBio, takes a string to set user's bio toprofile.setProfilePicture, takes a buffer and mime type to set user's profile picture tocomments.commentOnUser, takes a string and username to comment on, also takes a comment id and commentee id for replyingcomments.commentOnProject, takes a string and project id to comment on, also takes a comment id and commentee id for replyingcloud.createSession, takes a project id to create a cloud session onget, get a cloud variable, takes a name (with ☁ icon) and returns the valueset, set a cloud variable, takes a name (with ☁ icon) and valueset, fired when a cloud variable is set, returns (with ☁ icon) name and valuehandshake, fired when a handshake with the cloud server is performedpacket, fired when a packet is recieved, returns the parsed packetoutgoing, fired when there is an outgoing packet, returns the outgoing packetLogin as a user and get session info
const Scratch = require("scratch-site-api")
const user = new Scratch.User()
async function main() {
await user.login("username", "password")
console.log(await user.getSession().json)
}
Create a cloud session and log all variables
const Scratch = require("scratch-site-api")
const user = new Scratch.User()
async function main() {
await user.login("username", "password")
const cloud = user.cloud.createSession(12345678)
cloud.on("set", (var, val) => {
console.log(var, val)
})
}
Create a credentials.json file in the tests folder with a user and pass field
FAQs
A modern site api for scratch.mit.edu
We found that scratch-site-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.