
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Lose implementation of Golang's WaitGroup. It offers a different, very simple, way of working with async control flows.
Its strength is its simplicity. It offers no help dealing with errors or data as such (you have to use scope for that). In return you get a ridiculously simple interface.
npm install wait-group
const waitGroup = require('wait-group')
The module has a very simple interface. It only exposes one funcion, taking no arguments, that will give you an instance of a waitGroup. The waitGroup's exposed functions are:
wg.add(n : Number): Call this when you start a process that the waitGroup
has to wait for. n is usually just 1 and must be above 0. If it is
called without arguments, it is assumed that n = 1.wg.done(): Call this when an added function is done. For instance when a
callback returns or a promise resolves (or rejects).wg.wait(fn : function): Functions added with this will be called whenever
all that were added are done. If the waitGroup instance is aleady completed,
then it will be called immediately; much like you'd expect .then() on a
promise to behave.// Very simple, but it uses the entire interface
var wg = waitGroup()
wg.add(1)
wg.wait(function () {
console.log('setTimeout is done')
})
setTimeout(wg.done, 200)
// Here we run three requests in parallel, and handle the result.
var results = {}
var error = null
var wg = waitGroup()
wg.wait(function () {
if (error) return console.log('Oh no!')
console.log('We got:', results)
})
// first
wg.add(1)
someCallbackyRequest('/api/gimme-a', function (err, data) {
wg.done()
if (err) return error = err
results.a = data
})
// second
wg.add(1)
someCallbackyRequest('/api/gimme-b', function (err, data) {
wg.done()
if (err) return error = err
results.b = data
})
// third
wg.add(1)
someCallbackyRequest('/api/gimme-c', function (err, data) {
wg.done()
if (err) return error = err
results.c = data
})
It's less than 50 lines of code. Why are you reading this?
MIT
FAQs
Lose implementation of Golang's WaitGroup
The npm package wait-group receives a total of 2 weekly downloads. As such, wait-group popularity was classified as not popular.
We found that wait-group demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.