
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
smart-matter
Advanced tools
Parses front matter Yaml from a file path or a string and returns an Object. Used by squido.org.
Install with npm:
$ npm install --save smart-matter
smart-matter parses front-matter either from a file path or from a string containing front-matter.
If supplied, smart-matter will parse a date input into a Javascript Date Object. When using the file(path) API, smart-matter will return last modified date of the file.
Input is a string with the full path to the input file.
Params
input {String}: A full path string to the file with front matter.Input is a string contents which returns an object.
Params
input {String}: String with the contents of the file with front matter.import path from 'path';
import { file } from 'smart-matter' ;
const sm = file(path.join(__dirname, 'file.markdown'));
console.log('matter', sm);
This assumes that file.markdown is formatted similar to this:
---
title: Hello World
permalink: hello-world
date: '2021-07-03 19:17:00'
tags:
- my
- tags
---
## Hello world
smart-matter will parse this file and return an object like this:
{
title: "Hello World",
permalink: "hello-world",
date: "2021-07-03 19:17:00",
tags: [ "my", "tags" ],
matter: "title: Hello World\n
permalink: hello-world\n
date: 2021-07-03 19:17:00\n
tags: \n
- my\n
- tags\n",
file: "/Users/mark/Documents/Code/smart-matter/tests/test.markdown",
lastupdated: 2021-08-03T06:45:46.170Z,
hash: "b10a8db164e0754105b7a99be72e3fe5",
content: "\n\n## Hello world",
dateObject: 2021-07-03T09:47:00.000Z,
dateISO: "2021-07-03T09:47:00.000Z",
error: null,
empty: false
}
import fs from 'fs';
import { contents } from 'smart-matter';
const filePath = fs.readFileSync('file.markdown', 'utf8');
const sm = contents(filePath);
console.log('matter', sm);
This assumes that file.markdown is formatted similar to this:
---
title: Hello World
permalink: hello-world
date: '2021-07-03 19:17:00'
tags:
- my
- tags
---
## Hello world
smart-matter will parse this file and return an object like this:
{
title: "Hello World",
permalink: "hello-world",
date: "2021-07-03 19:17:00",
tags: [ "my", "tags" ],
matter: "title: Hello World\n
permalink: hello-world\n
date: 2021-07-03 19:17:00\n
tags: \n
- my\n
- tags\n",
hash: "b10a8db164e0754105b7a99be72e3fe5",
content: "\n\n## Hello world",
dateObject: 2021-07-03T09:47:00.000Z,
dateISO: "2021-07-03T09:47:00.000Z",
error: null,
empty: false
}
Added values to the object are:
matter: {String} The raw front-matter stringcontent: {String} The contents of the file outside of the front-matter datadate: {String} The original date valuedateObject: {Date} The date value parsed onto a Javascript DatedateISO: {String} The date value parsed and formatted into an ISO Datehash: {String} This is the md5 hash of the front-matter title (if supplied)lastupdated: {Date} The last updated value of the file on the diskNote: When using the
fileAPI more options are returned. Eg:file(the input file path) andlastupdated(the last updated date of the file on the disk)
FAQs
Parses front matter Yaml from a file path or a string and returns an Object. Used by squido.org.
We found that smart-matter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.