
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
github.com/novemberisms/stack
Advanced tools
This is my implementation of a LIFO stack in Go. Who hasn't made one of these?
Supports the following methods:
Push
Pushes a value unto the stack
Pop
Pops a value from the top of the stack
Peek
Gets the top element of the stack without popping it
Bottom
Gets the bottom element of the stack without popping it
Contains
Tests whether a value is in the stack
Len
Gets the number of items in the stack
Cap
Gets the capacity of the underlying slice
PopFirst
Pops the first value from the top of the stack that matches the given element
PopLast
Pops the first value from the bottom of the stack that matches the given element
I've avoided doing the whole return nil, err thing for such a simple data structure. I've opted instead to just return nil on all illegal cases.
nil when popping from an empty stacknil when peeking an empty stackPopFirst and PopLast returns true or false depending on whether the item was in the stack.
Since, you'd need a value that matches the item anyways to be able to search it. It makes no sense having them return the value you just searched for,This is licensed under the MIT license
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.