
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ts-vue-plugin
Advanced tools
WARNING: This plugin is in an alpha state. For a more polished experience, try the VS Code plugin vetur. This plugin, however, works with the Typescript language service. So you can use it with whatever editor you want.
This plugin does three things for Javascript and Typescript source in a .vue file:
vue-template-compiler to parse out the script section of a .vue file.new Vue(...) in order to propagate the Vue contextual type so that no type annotations are needed.It also resolves import other from "other.vue"; statements in the same manner.
It does not support completions in the template tag. It doesn't
even support the template or style tags.
module.exports = { ... in addition to ES6 export default { ....$ npm install ts-vue-plugin{
compilerOptions: {
"allowSyntheticDefaultImports": true,
"plugins": [{ "name": "ts-vue-plugin" }]
}
}
For example, in Emacs, add the line:
(add-to-list 'auto-mode-alist '("\\.vue$" . typescript-mode))
If you're Vim user, you can use tsuquyomi-vue.
Now you have typescript support inside the script tags. HTML and CSS support are non-existent right now.
FAQs
TypeScript Language Service Plugin for Vue
The npm package ts-vue-plugin receives a total of 594 weekly downloads. As such, ts-vue-plugin popularity was classified as not popular.
We found that ts-vue-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.