
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
h1. Watch
Watch is a script reloader. Watch monitors local Javascript and CSS files for changes and automatically reloads the modified file in your browser.
Examples:
Watch all CSS files for changes and reload them:
<script>_watch.css("*");</script>
Watch 1 Javascript file for changes and reload it:
<script>_watch.js("test.js");</script>
In this next example, test.js is a custom library that leaks 2 variables into the global namespace. We'll pass watch a cleanup function to remove the global variables (optional), and then a reinitialize function to reinit the test.js library.
Watch 1 Javascript file for changes, run a cleanup, reload the script, then run reinit:
<script>
_watch.js(
"test.js",
function () { //cleanup
delete window.testGlobal1;
delete window.testGlobal2;
},
function () { //reinit
test.init();
}
);
</script>
h3. Updates
Follow "@markmarkoh":http://twitter.com/markmarkoh for updates.
h3. Dependencies
The following needs to be installed to run watch:
Watch requires the following libraries, which should install automatically:
h2. Installation
npm install watch.js -g
h3. Alternative Installation (from source)
git clone git@github.com:markmarkoh/watch.git watch cd watch npm install . -g
h2. Running Watch
In the Terminal, change directory to the server root
cd ~/programs/web/sample watchjs
Alternatively:
watchjs path/to/static/resources
If everything is working, you should see a message like this:
Staring Watch.js server... Watch.js server started on port 7202 Add <script src="http://localhost:7202/watch.js"></script> to your HTML
Add that script to the bottom of your HTML document. Refer to the 'Examples' above for making API calls.
h4. Licence (GPL)
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see "http://www.gnu.org/licenses/":http://www.gnu.org/licenses/.
FAQs
A script and stylesheet reloader. Less browser refreshing.
We found that watch.js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.