
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
silvana-cli
Advanced tools
Silvana zkProver CLI tool
npm install -g silvana-cli
To confirm successful installation:
silvana --version
npm update -g silvana-cli
Make sure that you have the author and name fields set correctly in package.json and run
silvana deploy
or, to see the logs:
silvana deploy -v
You can see now your agent on https://silvascan.io/testnet/agents
The package should have at the root directory index.ts file that exports the zkcloudworker function:
// index.ts at the package root directory
import { Cloud, zkCloudWorker } from "@silvana-one/prover";
import { initBlockchain } from "@silvana-one/mina-utils";
import { initializeBindings } from "o1js";
import { MyWorker } from "./src/worker";
export async function zkcloudworker(cloud: Cloud): Promise<zkCloudWorker> {
await initializeBindings();
await initBlockchain(cloud.chain);
return new MyWorker(cloud);
}
and the directory in tsconfig.json for tsc compilation result should be dist:
"compilerOptions": {
"outDir": "./dist"
}
silvana --help
Silvana zkProver CLI tool v0.1.1 (c) Silvana 2025 www.silvana.one
Usage: Silvana [options] [command]
Silvana zkProver CLI tool
Options:
-V, --version output the version number
-v, --verbose verbose mode, print all logs
-f, --folder <folder> folder with repo
-r, --repo <repo> repo name
-d, --developer <developer> developer name
-m, --manager <pm> package manager: yarn | npm
-j, --jwt <jwt> JWT token
-h, --help display help for command
Commands:
deploy [options] deploy the repo to the cloud
verify [options] verify the contract of the repo
watch watch the job events for the repo
config save default configuration
help [command] display help for command
You need to install node and git and clone this repo
git clone https://github.com/silvanaone/silvana-cli
cd silvana-cli
touch yarn.lock
yarn
Running locally:
yarn cli
FAQs
Silvana zkProver CLI tool
We found that silvana-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.