
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Navigate webpages the easy way.
Note: you may need to install PhantomJS
$ npm install --save webnav
var webnav = require('webnav');
All methods return webnav. This allows for method chaining.
webnav.open(url, callback);
Opens a webpage from a url in PhantomJS, then executes the callback. The callback is passed a status parameter, which is set to 'success' if the webpage is opened successfully.
webnav.output(callback);
Specifies how the program should handle console output. Console output is passed as the first parameter into the callback function. By default, output is set to log messages preceded by '>'.
webnav.inject(filepath);
Injects a local file into the open webpage. Any variables and functions injected from inside a js file can then be accessed.
webnav.then(action, time);
Specify an action to take. The action parameter is a function, which is passed a phantom page object as its first argument. The page object is how you interact with the webpage. The time parameter specifies a delay in milliseconds before the next action should be taken.
webnav.start(callback);
Starts phantom with the current settings in webnav. The callback parameter is executed once phantom has started. Does not return anything.
webnav.exit();
Stops phantom from running and exits.
var webnav = require('webnav');
webnav
.open('http://my.site.com/path', function (status) {
console.log('opened site?', status);
})
.output(function (msg) {
console.log('console says:', msg);
})
.inject('./js/variables.js')
.inject('./js/functions.js')
.then(myFunction, 2500)
.then(exitFunction, 1000)
.start(function () {
console.log('started');
});
function myFunction(page) {
page.evaluate(function() {
// do something
});
}
function exitFunction() {
webnav.exit();
}
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.