
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
uss-validator
Advanced tools
Provides validation for Universal Schedule Standard objects.
This package may be used either on the frontend or backend. Is is written in ECMA Script 5, so it is widely compatible with any Javascript project.
Navigate to your project folder and enter the following in terminal:
npm install uss-validator
The uss-validator will be added into your project and your package.json file.
You call the validator with a Universal Schedule Standard Object as the only argument. The validator accepts Universal Schedule Standard objects as either JSON strings or JSON objects.
import validator from 'uss-validator'
// then get get a .uss file or an object
const universalScheduleStandardObject = JSON.parse(file)
const response = validator(universalScheduleStandardObject)
console.log(response)
It will return a response object.
The response object has four primary key values: isValid, errors, warnings and info.
{
isValid: true,
errors: [],
warnings: [
{
title: 'Stripboard missing Calendar',
location: ['5d01230c987033001725c908'],
message: 'There is a stripboard that is missing its calendarId'
}
],
info: {
isSchedule: true,
name: 'Small Sample Schedule',
source: 'Think Crew',
ussVersion: '1.0.0',
breakdowns: 3,
categories: 5,
elements: 6,
stripboards: 2,
calendars: 1
}
}
The isValid value is a boolean that denotes whether the USS object is considered to be a valid construction.
The errors and warnings values are arrays that may contain error objects that describe any issues with the USS object. Errors are considered fatal and always result in isValid returning false. Warnings are merely related to the user's data potentially being malformed, and are not fatal.
The info object contains various pieces of information about the USS object:
| Key | Value |
|---|---|
| isSchedule | boolean | true if the USS object contains both stripboard and calendar data |
| name | string | the name of the schedule |
| source | string | the originating site or app |
| ussVersion | string | the version of the standard this file is using |
| breakdowns | number | the number of breakdowns in the object |
| categories | number | the number of categories in the object |
| elements | number | the number of elements in the object |
| stripboards | number | the number of stripboards in the object |
| calendars | number | the number of calendars in the object |
The uss-validator will return errors or warnings in the following format:
{
title: string | the title of the error or warning,
message: string | the full error or warning message,
location: array | an array of text strings that will give clues as to where the error occurred in the file
}
Errors and warnings use the same object construction.
FAQs
Provides validation for Universal Schedule Standard (.uss) objects
We found that uss-validator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.