
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
webpack-service
Advanced tools
DEPRECATED in favour of webpack-build
A high-level wrapper around webpack which:
npm install webpack webpack-service
var webpackService = require('webpack-service');
webpackService({
// An absolute path to a webpack config file.
config: '/path/to/webpack.config.js',
//
// ---------------------
// Default configuration
// ---------------------
//
// Should webpack watch the source files for changes and rebuild in the
// background
watch: false,
// The delay between a change being detected and webpack starting the
// rebuild process
watchDelay: 200,
// Indicates that the config file should be watched for changes. Any changes
// will cause webpack to start rebuilding the bundle
watchConfig: false,
// Indicates that the compiled output should be cached. Ignored if the bundle
// is being watched
cache: false,
// Indicates that full output of webpack's compilation data should be returned
fullStats: false,
// If defined, a config's `output.path` prop will have "[bundle_dir]" substrings
// replaced with the value of `bundleDir`
bundleDir: null
}), function(err, stats) {
// Besides the usual stats data produced by webpack, the service adds extra props:
// stats.webpackConfig: the object passed in to webpack
// stats.pathsToAssets: an object mapping asset names to the full path of the emitted asset
});
FAQs
Webpack service
The npm package webpack-service receives a total of 0 weekly downloads. As such, webpack-service popularity was classified as not popular.
We found that webpack-service demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.