
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
userscript-composer
Advanced tools
Ability to compose userscripts for unified distribution.
Table of Contents
Elegant userscript build tool with:
userscript-composer is built top on cac, esbuild, picomatch, and terser to give you best development experience and production output. Thanks to authors and contributors of those packages as userscript-composer could not exists without their technologies.
To install quick as possible, you can use following commands to initiate building.
mkdir userscript-composer-playground
cd userscript-composer-playground
mkdir scripts
touch header.txt # header.txt will be prepended to unified output
npm init -y
npm install -g userscript-composer
# Or you may use GitHub for latest versions which might have bug fixes for NPM versions
npm install -g git+https://github.com/seia-soto/userscript-composer.git
The script above will install userscript-composer as global package.
If you don't want to install package as global, you can remove -g flag from the command and add following entry to script in package.json.
{
"scripts": {
"composer": "userscript-composer"
}
}
Now, bomb!
npm run composer -h
The reason of userscript-composer to exist is automating the build process of multiple userscripts into one userscript. To reach the goal, I decided to use transpilers and bundlers to build userscripts, and this made userscript-composer able to compile TypeScript, JSX files, and userscripts including dependencies.
Sure, we need some refactoring to enhance developer experience of userscript-composer project but here is the brief summary of the process.
cac process cli partesbuild bundles and transforms userscriptspicomatch recognizes glob patterns and exports to regular expressionterser compresses the outputIt's the basic thought I did first time to build this application. I think this would be helpful if you want to contribute.
Then go to development section to continue.
Before getting started, let's create some folders and files for userscript-composer to work with. Every options are changable, so don't worry.
Also, there are some terms used in this project:
Trivials
Shared options
The options below are shared in all commands.
Options:
--source [directory] Set source directory to build (default: scripts)
--out [directory] Set output directory for build (default: dist)
--minify Minify the output for production use (default: false)
--clean Clean the build directory before build (default: false)
-v, --version Display version number
-h, --help Display this message
userscript-composer initCreate new userscript-composer workspace with header.txt template, config.json file, and script directory.
This command runs userscript-composer build automatically after setting up.
If you give some arguments for build command, it will automatically apply it.
userscript-composer init [--source [directory]] [--out [directory]] [--minify] [--clean]
userscript-composer buildGenerate standalone userscript from source file.
--source [file].--out [file].userscript-composer build [--source [file]] [--out [file]] [--minify] [--clean]
userscript-composer batchBatch build userscripts from source directory and save bundled userscripts to output directory.
Generate standalone userscripts from source directory files including .user..
userscript-composer batch [--source [directory]] [--out [directory]] [--minify] [--clean]
userscript-composer unifyGenerate unified userscript bundling all userscripts from source directory.
--header [filename].--name [name].userscript-composer unify [--source [directory]] [--out [directory]] [--name [name]] [--header [headerfile]] [--minify] [--clean]
We provide the JavaScript API to build from Node.JS application via ES Module format. Read more about ES Module by Lin Clark.
By seeing the /src/index.ts, you can see what things are being exported via module.
Also, every functions necessary required to implement the build action has comment.
To make our development environment to be flatten, here are the list of necessary softwares we should use. As you know, the editor is not important and you may use any of released or your own.
.nvmrcThat's all.
WIP
FAQs
Ability to compose userscripts for unified distribution.
We found that userscript-composer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.