
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
evdevremapkeys
Advanced tools
A daemon to remap key events on linux input devices
The remapping of input key events is an problem, and one that has been solved at many levels over the years. On a traditional X11 desktop, the usual way to do this is with xbindkeys; it's simple and effective and you shouldn't try and write something different.
However, with the shift to Wayland, we have a problem. Wayland obviously isn't X11 so any X11 based remapping utility isn't going to work. Wayland compositors typically use libinput to manage input events, but while libinput supports remapping conceptually, it does not expose any mechanism to configure it. This is left as an exercise to the compositor and neither Weston nor Mutter expose remapping.
So where does this leave us? If we are to provide a remapping mechanism that is not dependent on the compositor, it must run below libinput, which means it must work with the linux input subsystem. And so, here we are.
There's only one real sane approach to doing event remapping at the input subsystem level: Read events from physical input devices, and then generate new input events on a virtual device managed through uinput.
One legitimate question is whether the virtual device attempts to fully replicate the original physical device, just with remapped events, or whether it's a dedicate device that only emits the new events which leaving the physical device free to send events directly to other clients.
Depending on your exact use-case, you might be able to leave the original physical device as-is, but for me, it turned out that I had to swallow the original events because they will be picked up by libinput and then trigger actions in my desktop environment.
To avoid this, you have to take a grab on the physical device, so no other client receives events, and then forward all un-modified events through your virtual device. It's annoying but unavoidable - you can't hide individual events from other clients.
The recommended way to install the program is to use pipx.
$ pipx install evdevremapkeys
You can also use pip, but on modern distros, pipx is a far better experience.
You will need to create an initial configuration file for the program to be able to run and doing anything useful.
It's recommended to start from one of the example config files and adapt it for your hardware and the remapping you need.
Place your final file at: ~/.config/evdevremapkeys/config.yml
evdevremapkeys
See RUNNING.md for more details.
FAQs
A daemon to remap key events on linux input devices
We found that evdevremapkeys demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.