
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
trumbowyg-https-prefix
Advanced tools
Trumbowyg is an MIT-licensed open source project and completely free to use.
However, the amount of effort needed to maintain and develop new features for the project is not sustainable without proper financial backing. You can support it's ongoing development by being a backer or a sponsor:
Trumbowyg is a simple and lightweight WYSIWYG editor, weight only 20kB minifed (8kB gzip) for faster page loading.
Visit presentation page: http://alex-d.github.io/Trumbowyg/
All you need to know about Trumbowyg is here: http://alex-d.github.io/Trumbowyg/documentation/ (or even on the home)
You can contribute to Trumbowyg with translations in languages you know.
Thanks to node and gulp, you can improve core script, style or icons easily.
First, fork and clone the repository
cd Trumbowyg # to go into the project's root directory
npm install # to install development dependencies
npm install -g bower gulp # to install bower and gulp command if you don't have them already
bower install # to install Trumbowyg dependencies (ie: jQuery)
gulp build # to build the project
gulp command launch default Gulp task watcher and rebuild on the fly.
For the latest release and announcements, follow on Twitter: @AlexandreDemode
This project is under MIT license.
FAQs
A lightweight WYSIWYG editor
We found that trumbowyg-https-prefix demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.