
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
watch-trigger
Advanced tools
A simple utility script that associates file pattern lists with commands to run when a change in one of those files is detected. Uses simple file polling to maximize consistently across platforms (at the expense of some performance).
A simple utility script that associates file pattern lists with commands to run when a change in one of those files is detected. Uses simple file polling to maximize consistently across platforms (at the expense of some performance).
Create configuration file in your project. It describes the files to include in the watch set and the command to run when any of those files change:
{
"include" : "src/**/*",
"command" : "make build --no-print-directory"
}
Then run watch-trigger with that configuration file:
node node_modules/watch-trigger/index.js my-config.json
The configuration file can be written as either JSON or JavaScript. If it is written in JavaScript, the module.exports should be a JSON object.
{
"include" : <glob pattern> OR [ <array of glob patterns> ],
"exclude" : <glob pattern> OR [ <array of glob patterns> ],
"command" : <command string>,
**OR**
"commands": [ <array of sequential command strings> ],
}
If multiple sets of glob patterns and commands are required, an array of sets can be used:
{
"sets" : [
{
"include" : ...,
"exclude" : ...,
"command" : ...,
},
{
"include" : ...,
"commands" : [ ... ],
},
...
]
}
The command string is passed directly to the shell for execution (using child_process.execSync), with one exception:
$1 will be replaced with the filename of the file whose modification triggered the commandbefore optionThe before configuration option can be used to describe command(s) that are run exactly once before the watch starts. watch-tigger does not wait for these commands to finish before starting the watch.
For example, this would start the dev-server (and presumably leave it running) and re-run the build-assets target whenever an asset file changed without restarting the dev-server.
{
"before" : "make dev-server --no-print-directory",
"include" : "src/assets/**/*",
"command" : "make build-assets --no-print-directory"
}
FAQs
A simple utility script that associates file pattern lists with commands to run when a change in one of those files is detected. Uses simple file polling to maximize consistently across platforms (at the expense of some performance).
The npm package watch-trigger receives a total of 12 weekly downloads. As such, watch-trigger popularity was classified as not popular.
We found that watch-trigger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.