
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This is a fork of anton-rudeshko/node-throw. If you are familiar with the original project, see Fork Changes below.
You can't use throw statement in expressions in JavaScript:
arg = arg || throw new Error('arg is required');
// ^^^^^
// Uncaught SyntaxError: Unexpected token 'throw'
This tiny library is wrapping throw in a function:
// Use capital T to distinguish this module from the throw keyword
const Throw = require('throw2');
// ...
arg = arg || Throw('arg is required');
This is particularly useful when using nullish coalescing operator and optional chaining operator:
value = obj?.nested?.value ?? Throw('value not found');
npm i throw2
CommonJS:
const Throw = require('throw2');
ESM:
import Throw from 'throw2';
You can compose dynamic error messages by providing multiple arguments:
typeof arg === 'string' || Throw('Invalid arg. Received:', arg, 'Should be string.');
You can also use your own error types:
/*...expression...*/ || Throw(new MyCustomError(arg1, arg2));
// Or
/*...expression...*/ || Throw(MyCustomError, arg1, arg2); // Creates a MyCustomError with arg1 and arg2
Throw as an expression is currently a Stage 2 TC39 proposal, so this package might no longer be necessary in the future.
The main difference is that node-throw uses Node.js API,
so it doesn't work in the browser without a polyfill.
throw2 works in any CommonJS environment. (e.g. noje.js and webpack)
Also, printf-like message formatting is not supported by throw2. Use template literals instead; or pass multiple arguments to the function. (see usage examples)
MIT (see LICENSE.md)
FAQs
Sugar syntax to throw exceptions as an expression.
We found that throw2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.