
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@apostrophecms/cache-redis
Advanced tools
This module enhances the core caching module, @apostrophecms/cache, to use Redis rather than MongoDB. This module does not set up the actual Redis store, but instead allows Apostrophe to access an existing Redis store through the standard Apostrophe caching API and an internal Redis client.
All normal Apostrophe cache API features are maintained in addition to the Redis-specific features described below.
To install the module, use the command line to run this command in an Apostrophe project's root directory:
npm install @apostrophecms/cache-redis
Configure the Redis cache module in the app.js file:
require('apostrophe')({
shortName: 'my-project',
modules: {
'@apostrophecms/cache-redis': {}
}
});
All options for this module should be applied to @apostrophecms/cache in project code. This module simply "improves" that core module (updates its features). The main caching module still does all the work.
Configure the underlying Redis client by adding a configuration object on the cache module's redis option.
// modules/@apostrophecms/cache/index.js
module.exports = {
options: {
redis: {
url: 'redis://alice:foobared@awesome.redis.server:6380'
}
}
};
By default, the client will look for a Redis server running on localhost port 6379. See all the client configuration options on the Node-Redis documentation.
Note that this module uses the 4.x version of Node-Redis, which changed its configuration options from earlier major versions.
The Apostrophe cache get and set methods take two arguments that are used for individual cache item keys:
| Argument | Description |
|---|---|
namespace | A namespace for related data. Apostrophe core often uses the active module's name for the namespace, e.g., @apostrophecms/oembed. |
key | The unique cache item key within a namespace. |
await apos.cache.get(namespace, key)
await apos.cache.set(namespace, key, value)
Example:
const fetch = node
// modules/api-connect/index.js
module.exports = {
apiRoutes(self) {
return {
get: {
// GET /api/v1/api-connect/set-cache-info
async setCacheInfo(req) {
const info = await myApiClient.get({ latest: true });
// 👇 This status will be "OK" if successful. This is due to the Redis
// API, not a common Apostrophe pattern.
const status = await self.apos.cache.set('api-connect', 'latest', info);
return { status };
},
// GET /api/v1/api-connect/get-cache-info
async getCacheInfo(req) {
// 👇 This will return the stored information or `undefined` if not
// set.
const latest = await self.apos.cache.get('api-connect', 'latest');
return { latest };
}
}
};
}
};
prefix for multiple sitesBy default, this module applies a prefix to cache keys in the store. This prefix is the shortname of the website, which automatically separates cache items if multiple Apostrophe sites share the same Redis store.
To disable the cache key prefix, set the cache module's prefix option to false.
// modules/@apostrophecms/cache/index.js
module.exports = {
options: {
prefix: false
}
};
To customize the prefix, set the prefix option to the desired string value.
// modules/@apostrophecms/cache/index.js
module.exports = {
options: {
prefix: 'project-alpha'
}
};
FAQs
Redis-based cache for the Apostrophe 3
The npm package @apostrophecms/cache-redis receives a total of 27 weekly downloads. As such, @apostrophecms/cache-redis popularity was classified as not popular.
We found that @apostrophecms/cache-redis demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.