
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
github.com/HorizonCamera/HorizonSDK-iOS
Advanced tools

Horizon SDK is a state of the art real-time video recording / photo shooting iOS library.
Some of the features of Horizon SDK include:
In order to use Horizon SDK on your app, you have to receive an API key by contacting us. The provided sample apps contain their own API keys.
The library can be used on devices running iOS version 8 or higher. You can build your application using the latest Xcode.
For more information take a look at the Installation and Quick Start guides of the documentation.
There are three Xcode projects in the Examples directory with examples of how to create a simple video recording application, a more advanced use of the library and a Swift project.
The HorizonSDKDemo example app demonstrates the same basic functionality of the HorizonSDK: Creating a preview, instanciating the camera and having a record button. HorizonSDKDemo requires iOS 8.0 or later.
The AdvancedHorizonSDKDemo example app demonstrates a more advanced functionality of the HorizonSDK: There are two previews, a simple and a leveled one. The app responds to device orientation events and demonstrates some of the features available on HorizonSDK. AdvancedHorizonSDKDemo requires iOS 8.0 or later.
The SwiftHorizonSDKDemo example app provides a simple app written in Swift that shows how to integrate HorizonSDK library with a Swift project. SwiftHorizonSDKDemo requires iOS 8.4 or later.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.