
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
choo-devtools
Advanced tools
Console devtools for Choo. Useful for inspecting the state of applications, tuning performance, and quick iteration. No installation needed means it works in all browsers and Electron! :sparkles:
var choo = require('choo')
var app = choo()
if (process.env.NODE_ENV !== 'production') {
app.use(require('choo-devtools')())
}
app.mount('body')
var devtoolStore = require('choo-devtools')(opts)This module exposes a function that return a choo store. The function accept a single option argument, with the following properties:
eventName, data, timing and should return true
(the event will be logged) or false (the event wont be logged).choo.helpPrint out information about all commands.
❯ choo.help
choo.stateLog out the Choo state object.
❯ choo.state
choo.debugLog all state modificiations using object-change-callsite. Logs out the key, value, and stack trace for the change. Useful when you're dealing with unexpected values in your state. Especially useful when enabling asynchronous stack traces in the devtools.
// Enable debugging
❯ choo.debug
// Disable debugging
❯ choo.debug = false
choo.storageLog out information about the browser's storage capabilities.
❯ choo.storage
choo.logLog out the last 150 events that occured in Choo. Useful during debugging to quickly figure out which sequences of events were responsible for the current state.
❯ choo.log
To enable state snapshots on each event, call choo.debug. Be warned that
this may severely impact performance – it's recommended to only use this for
debugging state.
choo.copy([selector])Serialize the current state to JSON and copy it to the clipboard. Can be passed
a selector (such as href) to do a partial copy. Useful if you want to create
a test based on the current application state.
// Copy all of state.
❯ choo.copy()
// Copy `state.href`.
❯ choo.copy('href')
choo.routesGet an array with the registered routes.
❯ choo.routes
choo.perf[type]Log out performance metrics for Choo. There are different types of entries we can show:
choo.perf.all Log out all data.choo.perf.core Only log out data about Choo's built-in methods.choo.perf.events Only log out information about the event bus.choo.perf.components Only log out information about components.FAQs
Console devtools for Choo
The npm package choo-devtools receives a total of 63 weekly downloads. As such, choo-devtools popularity was classified as not popular.
We found that choo-devtools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 27 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.