
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Core SDK for building multi-platform chat bots. Provides the Chat class, event handlers, JSX card runtime, emoji helpers, and type-safe message formatting.
npm install chat
import { Chat } from "chat";
import { createSlackAdapter } from "@chat-adapter/slack";
import { createRedisState } from "@chat-adapter/state-redis";
const bot = new Chat({
userName: "mybot",
adapters: {
slack: createSlackAdapter({
botToken: process.env.SLACK_BOT_TOKEN!,
signingSecret: process.env.SLACK_SIGNING_SECRET!,
}),
},
state: createRedisState({ url: process.env.REDIS_URL! }),
dedupeTtlMs: 600_000, // 10 minutes (default: 5 min)
});
bot.onNewMention(async (thread) => {
await thread.subscribe();
await thread.post("Hello! I'm listening to this thread.");
});
bot.onSubscribedMessage(async (thread, message) => {
await thread.post(`You said: ${message.text}`);
});
Tip: PostgreSQL and ioredis adapters are also available for production. See State Adapters for all options.
| Option | Type | Default | Description |
|---|---|---|---|
userName | string | required | Default bot username across all adapters |
adapters | Record<string, Adapter> | required | Map of adapter name to adapter instance |
state | StateAdapter | required | State adapter for subscriptions, locking, and dedup |
logger | Logger | LogLevel | "info" | Logger instance or log level ("silent" to disable) |
streamingUpdateIntervalMs | number | 500 | Update interval for fallback streaming (post + edit) in ms |
dedupeTtlMs | number | 300000 | TTL for message deduplication entries in ms. Increase if webhook cold starts cause platform retries (e.g., Slack's http_timeout retry) that arrive after the default window |
If you use an AI coding agent like Claude Code, you can teach it about Chat SDK:
npx skills add vercel/chat
Full documentation is available at chat-sdk.dev/docs.
Chat class referenceMIT
FAQs
Unified chat abstraction for Slack, Teams, Google Chat, and Discord
The npm package chat receives a total of 126,924 weekly downloads. As such, chat popularity was classified as popular.
We found that chat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.