
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
stream-size
Advanced tools
stream-size is a non-destructive transformation for Node.js streams that adds a sizeInBytes property to your streams.
It also allows you to limit streams exceeding a maximum size.
import { Readable } from 'stream';
import { createWriteStream } from 'fs';
import getSizeTransform from 'stream-size';
const MAX_SIZE_ALLOWED_IN_BYTES = 10 * 1024 * 1024; // 10 MB
const downloadResource = (resourceInputStream: Readable) => {
// Note that no maximum size is required, if you don't pass a value the stream won't be limited.
const pipedStream = resourceInputStream.pipe(
getSizeTransform(MAX_SIZE_ALLOWED_IN_BYTES),
);
const localFileWriteStream = createWriteStream('temp-file');
pipedStream.pipe(localFileWriteStream);
localFileWriteStream.on('close', () => {
console.log(
`Input resource completed read! It has ${pipedStream.sizeInBytes} bytes.`,
);
// Now you can do something with 'tmp-file' if you want
});
};
Sometimes you need a remote resource content-length but the server does not send back that header. This usually happens when trying to upload a third-party resource to an S3 bucket.
In order to get the size of the resource you can pipe it to the local machine filesystem and get the size, however, if the resource is provided by a malicious actor you could end up filling your machine's disk and crashing the system.
To prevent that you need to stop downloading the resource when a maximum size is reached.
This package supports it, as well as directly returning the content-length of the input stream in a single operation.
FAQs
Get the size of a stream and abort it if threshold is reached
We found that stream-size demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.