
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
xgettext-webird
Advanced tools

Extracts translatable strings from source. Identical to xgettext(1) but for template languages.
tl;dr Get translatable strings from templates into Poedit.
React's JSX and Jade are todos (PRs are much appreciated).
In the following Handlebars example translatable content is passed to helpers (_ and ngettext):
<button>{{_ "Sign in"}}</button>
<p>{{count}} {{ngettext "country" "countries" count}}</p>
With Handlebars, this requires helpers being registered:
Handlebars.registerHelper('_', function(msgid) {
return i18n.gettext(msgid);
});
Handlebars.registerHelper('ngettext', function(msgid, plural, count) {
return i18n.ngettext(msgid, plural, count);
});
What this i18n object refers to is up to you. Some (client/server) options are:
xgettext-webird parses the strings above out of your templates into gettext's PO files. These PO files are then translated and compiled to binary MO files using applications like Poedit. The MO files are passed as input the i18n library (above).
$ npm install -g xgettext-webird
$ xgettext-webird [OPTION] [INPUTFILE]...
-D|--directory add directory to list for input files search.-o|--output write output to specified file (default: stdout).-L|--language specifies the language of the input files (default: determine from file extension). Use the language's full name from the template language support list above.--from-code encoding of input files (default: ascii).-k|--keyword additional keyword to be looked for (default: _,gettext,ngettext:1,2).--force-po write PO file even if empty (default: false).--no-location don't add file and line references (default: false).Go to File - Preferences... in Poedit and add a new parser in the Parsers tab:
Nunjucks*.nunjxgettext-webird -L Swig --force-po -o %o %C %K %F-k %k%f--from-code=%cVolt*.voltxgettext-webird -L Volt --force-po -o %o %C %K %F-k %k%f--from-code=%cPlease note that in this Windows example you have to use xgettext-webird.cmd. The .cmd extension should not be there on *nix platforms.
npm install.npm test to lint & test.xgettext-template initial development was founded by Dijiwan. This xgettext-webird project is a fork of xgettext-template.
FAQs
Extract translatable strings from templates
The npm package xgettext-webird receives a total of 2 weekly downloads. As such, xgettext-webird popularity was classified as not popular.
We found that xgettext-webird demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.