
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
✚ Easily persist your own autonomous Page View Counter for free (no VPS or database plans required).
To automatically create all necessary files and install the dependencies, run in an empty directory:
npx -y countty@latest init
npx -y countty@latest init --plugin
npm run dev
Example:
![]()
[!TIP]
- You can test it locally, even if you don't have a Cloudflare account.
/createPOST.slug: string./views and /badge ⭐️0 when the slug does not exist.GET.Examples:
<url>/views?slug=github:profile
<url>/badge?slug=github:profile
[!TIP]
🛡️ You can customize your Badge, for example:
- label:
<url>/badge?slug:github:profile&label=views
- Default:
views.- labelColor:
<url>/badge?slug:github:profile&labelColor=70a1ff
- Label color.
- color:
<url>/badge?slug:github:profile&color=98cc00
- Views background color.
- style:
<url>/badge?slug:github:profile&style=flat
- Supported:
flat,flat-square,plastic,social, andfor-the-badge.- logo:
<url>/badge?slug:github:profile&logo=PHN2Zy...C9zdmc+
- An SVG directly encoded to Base64.
/peek0 when the slug does not exist.GET.Example:
<url>/peek?slug=github:profile
/removePOST.slug: string./backupPOST./listPOST./resetPOST./restorePOST.string (send the SQL backup content directly).[!NOTE]
- ⚠️ The
resetandrestoreroutes are destructive actions: use them carefully.
For production use, you will need a Cloudflare account to proceed.
npm run deploy
[!TIP]
- You can have an
.envfile for development and another for production.- Change your Worker app name using the
nameproperty inwrangler.jsonc.
- Default is
countty.
To safe use your token in production without uploading .env files, you can create a secret:
npm run secret # Then put your COUNTTY_TOKEN from .env file.
[!IMPORTANT]
By default, the token is randomly generated with
100characters and the URL is"http://localhost:8787". You can change it in the.envfile, for example:COUNTTY_URL='https://countty.<your-subdomain>.workers.dev' COUNTTY_TOKEN='your-secret-token'
Countty includes a CLI helper to simplify the creation, backup, and maintenance of your counter directly from the terminal.
npx countty create <slug>: Create a new counter.npx countty views <slug>: View and increment counter statistics.npx countty peek <slug>: View counter statistics.npx countty remove <slug>: Remove permanently an existing counter.npx countty backup: Backup the Countty used table to ./backups/ directory.npx countty list: Return the number of slugs and list all Countty slugs.npx countty reset: ⚠️ Reset all counters permanently.npx countty restore <backupPath>.sql: ⚠️ Drop the Countty used table if it exists, then run the SQL dump (experimental).--help - Show help message.--env <path> - Specify a custom .env file path.[!NOTE]
- ℹ️ It's not possible to use custom routes with the Counter CLI helper.
- ⚠️ The
resetandrestorecommands are destructive actions: use them carefully.
[!TIP]
The CLI automatically loads environment variables from
.envfile in your current directory. Use--envflag to specify a different location.
You can customize your Countty using the options available at the time of creation:
import type { CounttyOptions } from 'countty';
import { createCountty } from 'countty';
const options: CounttyOptions = {
// Specifies the table name in the SQLite Durable Object.
table: 'countty',
// Sets the global cache for `views`, `badge`, and `list` routes (default: no cache).
cacheMs: 1000,
// Rate limiting configuration:
rateLimit: {
maxRequests: 100, // Maximum requests allowed in the time window.
windowMs: 10000, // Time window in milliseconds.
blockDurationMs: 10000, // Block duration when limit exceeded.
},
};
const { Worker, Countty } = createCountty(options);
// ...
[!TIP]
You can also personalize the
cacheMsoption directly from each route.
[!IMPORTANT]
Changing the table name won't migrate data from a previous table.
initThe init command installs three dependencies in package.json:
[!NOTE]
countty subdependencies
- badge-maker: To create badges dynamically.
- bcryptjs: For improved authentication security with native Node.js.
- lru.min: For cache in memory, performance improvements, and an efficient rate limit.
Data retrieved from the above links on October 1, 2025:
Workers:
100,000requests per day.- No charge for duration.
10 millisecondsof CPU time per invocation.Durable Objects:
100,000requests per day.13,000 GB-sper day (gigabyte-seconds of compute duration while the object is active in memory).SQLite:
5 millionrows reads per day.100,000rows writes per day.5 GB(total) SQL Stored data.
Countty itself does not collect, process, or analyze any personal data whatsoever. However, Cloudflare Workers provides observability dashboards that may log request metadata for monitoring purposes.
[!TIP]
For even more privacy, you can add the option
"send_metrics": falseto your wrangler.jsonc file.
Countty is under the AGPL-3.0 License.
Copyright © 2025-present Weslley Araújo and Countty contributors.
FAQs
✚ Easily persist your own autonomous Page View Counter for free (no VPS or database plans required).
The npm package countty receives a total of 18 weekly downloads. As such, countty popularity was classified as not popular.
We found that countty demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.