
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

This is a very simple tool designed to crawl websites, producing data on what each page links to and what static assets they depend on.
The tool can be used as either a command line interface, to produce JSON formatted results, or via the web interface that can graph the dependencies between all internal pages and their assets from the target website.
It's worth noting that this tool works best on sites with few broken links, and that output can get rather large if the site has many pages.
Ensure your machine has node installed, along with node's package manager npm.
Once node & npm are installed, clone this repo and run npm install from the project root. This will
install all the required dependencies, and run tests to ensure everything is configured correctly.
Once installed, you can run webcrawler by executing ./bin/webcrawler from the project root. A usage
script will be printed if you run webcrawler with no arguments.
crawl <target> <jsonFile>The crawl command can be used to recursively crawl the supplied target. If no JSON file target
is provided, then the result to be outputted to standard out. Otherwise the data is dumped to the
file provided as the jsonFile argument.
serveTo access the web interface, run webcrawler with the argument serve. This will boot a server on
port 3000 that is then accessible at http://localhost:3000. From here, you can enter the target
URL and the results will be graphed onscreen.
Log levels are set via the environment variable LOG_LEVEL. To run with debug output, try
LOG_LEVEL=debug ./bin/webcrawler <cmd>....
Much of the d3 code was adapted from the flare Hierarchical Edge Bundling demo, found here, though now wrapped in an angular directive.
Lawrence Jones - lmj112@ic.ac.uk
FAQs
Crawls given domains to provide a site map of static assets
We found that webcrawler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.