
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Event-Based chess Algorithm for NodeJS
npm i chess-node
Typescript
import * as chess from 'chess-node'
or
Only import the Game Class
import Game from 'chess-node'
JavaScript w/ CommonJs
const chess = require('chess-node')
or
Only import the Game Class
const Game = require('chess-node').default
The default export or the Game Class takes in 5 arguements while consturcting. 3 of them are optional. Let's go through all of them.
It's an instance of the EventEmitter class from the events module of NodeJS
Note: You should provide a fresh instance of the EventEmitter class
A unique string with which the Game class can listen to events emmited. We'll come back to this later
3rd and 4th Param is an instance of the Player Class. You can ignore these as the Game Class will create them for you.
The Board class. You can Ignore this as well. Basically it's the chess board for the Game.
Construction Example:
import { EventEmitter } from 'events'
import Game from 'chess-node'
const game = new Game(new EventEmitter(), 'chess-game-1')
This fact is not that fun now that I think about it. Well, Anyway.
Now that you have created a new instance of Game, you can now call methods inside it.
The method start starts a new game in the instance of the Game you just created.
Game.start() takes 4 arguements. 3 of them are required.
This a function which prints the board each time a move occurs
The ID of the white player
The ID of the black player
A function which will execute right after the move has been made.
Example:
game.start((message) => {
//This will print the board on to the console each time
console.log(message)
}, 'cool_unique_id', 'cooler_unique_id', () => console.log(game.board.getPieces()))
Now we get to the fun part, Making a move. Step 1: Flir- oh wait, Wrong guide. Sorry about that. Where were we? Ah yes, Making a move IN THE GAME.
To make a move, you have to emit an event in the eventEmitter object you passed in while consturcting
While emiting you need to pass 3 arguments.
The string you passed in while constructing.
The move you want to make.
It is an object which has 2 fields
Those are from the current position of the piece and to the position to the piece move to.
interface Move = {
to: Tile
from: Tile
}
genMove()The genMove(): Tile | null function takes in 1 argument and returns the the Tile object if it's a valid position.
Function to print the board
The ID of the player whose making the move.
Example:
import { EventEmitter } from 'events'
import Game, { genMove } from 'chess-node'
const game = new Game(new EventEmitter(), 'chess-game-1')
game.start((message) => console.log, 'player_1', 'player_2')
// Moves from B1 to C1
const [from ,to] = [genMove('B1'), genMove('C1')]
// Only allow valid moves to get passed
if (!from || !to) return throw new Error('Invalid Move')
game.eventEmitter.emit('chess-game-1', move, (message) => console.log(message), 'player')
The eventEmitter will emit gameOver when the game ends.
and It'll also print the board and winner in the func parameter while the game ends
game.eventEmitter.emit('chess-game-1', move, (message) => console.log(message), 'player')
if the game ends, it'll log one of the following strings:
<Colour_1> is in checkmate, <Colour_2> wins!StalemateThat's about it. Better docs comming soon, Hopefully. Now try it out. Have a great day!
FAQs
Chess on NODE
We found that chess-node demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.