
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A map that creates a default object if one does not exist.
| What | Where |
|---|---|
| Discussion | https://github.com/bigeasy/vivifyer/issues/1 |
| Documentation | https://bigeasy.github.io/vivifyer |
| Source | https://github.com/bigeasy/vivifyer |
| Issues | https://github.com/bigeasy/vivifyer/issues |
| CI | https://travis-ci.org/bigeasy/vivifyer |
| Coverage: | https://codecov.io/gh/bigeasy/vivifyer |
| License: | MIT |
npm install vivifyer
Extant is an implementation of SQL's COALESCE that I've used for some time to
deal with the fact that JavaScript truthiness will treat '' and 0 as true so
the || operator can't always be used to create given or default one-liner.
const { compare, raise, equal } = require('vivifyer')
We use the name "extant" on NPM because we want the first extant argument.
README.mdThis README.md is also a unit test using the
Proof unit test framework. We'll use the
Proof okay function to assert out statements in the readme. A Proof unit test
generally looks like this.
require('proof')(4, async okay => {
okay('always okay')
okay(true, 'okay if true')
okay(1, 1, 'okay if equal')
okay({ value: 1 }, { value: 1 }, 'okay if deep strict equal')
})
You can run this unit test yourself to see the output from the various code sections of the readme.
git clone git@github.com:bigeasy/vivifyer.git
cd vivifyer
npm install --no-package-lock --no-save
node test/readme.t.js
The 'extant' module exports a single coalesce function.
const vivifyer = require('vivifyer')
Note that Extant is SQL's COALESCE. It returns the first non-null-like value,
that is the first value that is not == null, which would be null or
undefined. If there is no such argument it returns null.
okay('test')
FAQs
A map that creates a default object if one does not exist.
We found that vivifyer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.