
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Cloud Commander a file manager for the web with console and editor.

npm i cloudcmd -g
For starting just type in console:
cloudcmd
Open url http://localhost:8000 in browser.
You will see something similar to this.

Cloud Commander could be easily deployed to Heroku.
Cloud Commander could be used as middleware for node.js applications based on socket.io and express:
Init package.json:
npm init -y
Install dependencies:
npm i cloudcmd express socket.io -S
And create index.js:
import http from 'node:http';
import {cloudcmd} from 'cloudcmd';
import {Server} from 'socket.io';
import express from 'express';
const app = express();
const port = 1337;
const prefix = '/';
const server = http.createServer(app);
const socket = new Server(server, {
path: `${prefix}socket.io`,
});
const config = {
name: 'cloudcmd :)',
};
const filePicker = {
data: {
FilePicker: {
key: 'key',
},
},
};
// override option from json/modules.json
const modules = {
filePicker,
};
const {
createConfigManager,
configPath,
} = cloudcmd;
const configManager = createConfigManager({
configPath,
});
app.use(prefix, cloudcmd({
socket, // used by Config, Edit (optional) and Console (required)
config, // config data (optional)
modules, // optional
configManager, // optional
}));
server.listen(port);
The docker images are provided for multiple architectures and types. The following list shows all existing images:
| Architecture | Type |
|---|---|
| amd64 | linux |
| arm64 (arm/v8) | linux |
| amd64 | linux-alpine |
| arm64 (arm/v8) | linux-alpine |
Cloud Commander could be used as a docker container this way:
docker run -it --rm -v ~:/root -v /:/mnt/fs -w=/root -p 8000:8000 coderaiser/cloudcmd
Config would be read from home directory, hosts root file system would be mount to /mnt/fs,
8000 port would be exposed to hosts port.
Also you could use docker compose with docker-compose.yml:
version: '2'
services:
web:
ports:
- 8000:8000
volumes:
- ~:/root
- /:/mnt/fs
image: coderaiser/cloudcmd
When you create this file run:
docker-compose up
More documentation you can find on https://cloudcmd.io/.
There is a lot ways to be involved in Cloud Commander development:
MIT
FAQs
File manager for the web with console and editor
The npm package cloudcmd receives a total of 2,219 weekly downloads. As such, cloudcmd popularity was classified as popular.
We found that cloudcmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.