
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
weaver-sdk
Advanced tools
A library that gives you access to the Weaver platform from your JavaScript app.
This readme covers development documentation, for usage documentation, see: weaver-docs
To get a weaver installation up and running, use the following command:
./start-backend.sh
This pulls the weavebase-api repo, builds the api from there, and runs tests on the docker compose stack in that repository.
In the .gitlab-ci.yml file the branch of the weavebase-api for the continuous
integration tests is set. In order to run a full test on an updated version of
the weavebase-api, or use updated images, update the mentioned branch to the
feature version that needs testing.
$ yarn
Please note that these require a running weaver installation (such as provided by the docker composition), and the contents of that installation will be wiped as part of the test run.
$ yarn test
By default most output is suppressed. In order to enable console.logs for
local testing, comment out the following line in test/globalize.coffee:
# Suppress log output
require('mocha-suppress-logs')()
Follow the sysunite coffeescript style guide
SAST has been configured and runs on a MR, the output report is on JSON format. In order to view the report on a more human way:
semgrep-stast:sastFAQs
Weaver SDK for JavaScript
We found that weaver-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.