
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
weak-ref-cache
Advanced tools
The weak-ref-cache package is a utility module designed to help you manage and reuse weak references to objects in JavaScript. With this package, you can retrieve weak references to objects and compare them using the same equality comparison as you would use for the objects themselves. Furthermore, it ensures that only one WeakRef instance is created per object, promoting memory efficiency.
npm install weak-ref-cache
Here's how you can use the weak-ref-cache package:
getWeakRef function from the package.getWeakRef function to get a weak reference to an object.getWeakRef function just like you would compare the objects themselves.import getWeakRef from "weak-ref-cache";
const obj = { foo: "bar" };
const weakRef = getWeakRef(obj);
console.log(weakRef === getWeakRef(obj)); // true
console.log(weakRef === new WeakRef(obj)); // false
getWeakRef(obj: object): WeakRefobj (Object): The object for which you want to get a weak reference.WeakRef instance representing a weak reference to the obj. If a weak reference to the obj was previously created by getWeakRef, it returns the same WeakRef instance.FAQs
Returns the same unique WeakRef instance per object.
We found that weak-ref-cache demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.