
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
$ toush src/engines/thomas.js,henry.js src/controllers/fat.js,thin.js
toush does three things in one command:
$ npm install -g toush
Primarily intended to help make better tutorials. Its great when tutorials provide mkdir and touch snippets - less thought impedance than mouse clicking in IDE. Toush is three times faster than mkdir,touch, open. Also works for Windows.
Secondarily, power user way of creating/opening files during development. Try it, you'll never go back!
Just open all existing files in a dir:
$ toush src/engines/*
Open all existing .ts files in all sub-directories:
$ toush src/**/*.ts
Create/open multiple files per directory (comma separted files per dir):
$ toush src/engines/thomas.js,henry.js src/controllers/fat.js,thin.js
Tradiltional equivalent of the above (dont need to do it this verbose way anymore!)
$ toush src/engines/thomas.js src/engines/henry.js src/controllers/fat.js src/controllers/thin.js
Should you want to create empty directories, end param string with fwd slash:
$ toush src/empty/dir/for/later/ ./and/another/ and-make/this-file-by-the-by.js
By default 'code' is executed to open the files in vscode. To change this, say to 'open' for Theia IDE (Apache Che, Gitpod):
toush -c open
This creates a toushrc file in your current directory. You can simply move the file to any higher up directory to share config across different projects.
toush -c. Move touchrc file to parent directory to reuse across projects.
Tested with Theia IDE - gitpod, Apache Che ( set to open). For vscode set to code.Updated with globbing.
Run tested ok on mac, linux, windows.
FAQs
power touch cli command. mkdir, touch, open in IDE in one go.
We found that toush demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.