
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
teamchatviz
Advanced tools
by moovel lab and moovel dev team

#teamchatviz enables you to explore how your Slack team works:
Client app is built with React and JSPM. Vizualisations leverage react-vis and d3. Server is written in ES6+ using Koa 2 and Babel. PostgreSQL is used a database with the help of pg-promise.
Nota bene: #teamchatviz is not created by, affiliated with, or supported by Slack Technologies, Inc. Please comply with your applicable data protection and labour law regulations when using our tool.
See the project page moovel.github.io/teamchatviz for more infos, screenshots and a screenrecording.
Online demo app under teamchatviz-demo.moovel.com (with fake Slack team data, generated with Faker.js).
Currently supported browsers: latest Chrome/Chromium, Firefox or Safari.
http://<hostname of your server>/api/auth/slack/callbackhttp://<hostname of your server> and press Add to Slack button. Grant all required permissions to the Slack app that you created on step #1.Never heard of Heroku? Here's how to install it: https://youtu.be/8lzdCWoiDbY
See docker image by Xqua
You need a recent Node JS version (4+) installed and JSPM 0.17 Beta (npm install jspm@beta -g).
git clone git@github.com:moovel/teamchatviz.git and cd teamchatviz.npm install - install server npm dependencies.cd client && npm install && jspm install - install client dependencies.cd ....env file with the following content:PORT=3333
SLACK_CLIENT_ID="<client id of your slack app>"
SLACK_CLIENT_SECRET="<slack app secret>"
DATABASE_URL="<postgresql database URL e.g. postgres://teamchatviz:teamchatviz@localhost/teamchatviz>"
PUBLIC="false"
ANONYMIZE="false"
SESSION_SECRET="secret"
If PUBLIC === true the data loaded into the system will be public and will not require authentication via Slack. If ANONYMIZE === true the data loaded into the system will be replaced with the fake data using Faker.js. Anonymization will happen only on the initial data loading and before the data reaches the database.
If PUBLIC === true, Add to Slack button on the Main page is hidden and login is disabled. If you change the PUBLIC setting for an existing instance, the changes will apply only after a restart of the server.
npm run up.npm start - start the server.http://localhost:$PORT in your browser.In order to create a database in PostgreSQL you need to start psql client. On Linux systems you can run sudo -u postgres psql for this. On OS X you can start it via the UI of Postgres.app.
Then you may run the following commands to create a user called teamchatviz with the password teamchatviz and a database called teamchatviz:
CREATE DATABASE teamchatviz;
CREATE ROLE teamchatviz WITH LOGIN CREATEDB PASSWORD 'teamchatviz';
ALTER USER teamchatviz VALID UNTIL 'infinity';
ALTER DATABASE teamchatviz OWNER TO teamchatviz;
GRANT ALL ON DATABASE teamchatviz TO teamchatviz;
\c teamchatviz
ALTER SCHEMA public OWNER TO teamchatviz;
npm test
See the full list of dependencies in the client's package.json and server's package.json.
FAQs
Slack Data Vizualization App
We found that teamchatviz demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.