
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
timecontroljs
Advanced tools
Fake the javascript time for your projects.
import { sleep, setTime } from "timecontrol";
setTime(0); // It's 1970
console.log(Date.now()); // 0
sleep(6000); // Instantly fakes 6000 milliseconds
console.log(new Date().getTime()); // 6000
await sleep(2000); // Also if you await sleep, it works such a normal sleep function
console.log(Date.now()); // 8000
Also there are a lot of functions to manipulate time, from modify time speed to stop the time.
import * as time from "timecontrol";
time.set(0); // It's 1970
time.increaseSpeed(2); // speed *= 2
const promise = new Promise((resolve) =>
setTimeout(() => {
resolve(Date.now());
}, 2000)
);
console.log(await promise); // 4000, the time goes x2
time.pause(); // stop the time, now always be fixed to the current 4000 time.
const { sleep } = time;
await sleep(1000);
console.log(Date.now()); // 4000
time.unpause();
await sleep(1000, 100);
// first param, the time that will be advanced
// second param, the real time that sleep function will do
time.restore(); // It also reverts time speed
time.switchUnit("y"); // now time is on year unit.
time.advance(5); // time will advance 5 years
console.log(Date.now()); // From now 5 years on future
time.back(100); // 95 years from now to the past
FAQs
Time control for your project. Fake javascript time.
We found that timecontroljs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.