
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ClickTone is a lightweight helper for UI sound feedback. It wraps the Web Audio API, giving you instant click‑sounds with volume control, throttling, callbacks, and an iOS resume workaround.
clicktone
ClickTone is a lightweight helper for UI sound feedback. It wraps the Web Audio API, giving you instant click‑sounds with volume control, throttling, callbacks, and an iOS resume workaround.
1.2kB gzipped
➤ Install
yarn add clicktone
➤ Import
import ClickTone from 'clicktone';
➤ Usage
<audio preload="auto">
<source id="click-source" src="./click.mp3" type="audio/mpeg" />
<source src="./click.ogg" type="audio/ogg" />
</audio>
const sound = new ClickTone({
// Any of the forms work:
// file: './sound.mp3',
// file: new URL('./sound.mp3', import.meta.url).href,
// file: document.querySelector('#click-source') as HTMLSourceElement,
file: { id: 'click-source' },
volume: 0.7,
throttle: 100,
callback: () => console.log('done'),
debug: true,
});
button.addEventListener('click', () => click.play());
ClickTone uses the Web Audio API, which supports many audio file formats: MP3, WAV, OGG, AAC and others. Note that not all browsers support these formats.
Tip: you can also override the source at call‑time: click.play('./alt.wav').
➤ Options
| Option | Type | Default | Description |
|---|---|---|---|
file | string | HTMLSourceElement | { id: string } | – | Audio source. Either a direct URL, an actual <source> element, or an object whose id maps to a <source> already in the DOM. |
volume | number | 1 | Playback volume 0–1. |
callback | ((error?: Error) => void) | null | null | Called after playback ends or if an error occurs. |
throttle | number | 0 | Debounce interval in ms. Playback requests arriving sooner are ignored. |
debug | boolean | false | Log internal errors/warnings to the console. |
➤ License
clicktone is released under MIT license.
FAQs
ClickTone is a lightweight helper for UI sound feedback. It wraps the Web Audio API, giving you instant click‑sounds with volume control, throttling, callbacks, and an iOS resume workaround.
We found that clicktone demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.