
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
github-searcher-cli
Advanced tools

GitHub has some great search functionality (especially for code searches). That being said, it can be annoying to look for code samples in various repositories via the web search UI (especially when switching from doing work in the Terminal). Thus, this command line tool hopes to replace some of the functionality that the GitHub search service provides.
This CLI is in active development and is missing some key features I hope to implement (maybe with the help of you)!
npm install github-searcher-cli -g
ghs setupThis should be the first command you execute. It will ask for a personal access token that will be used to authenticate future requests.
ghs codeThis command will allow you to search matching code fragments for a given search parameter set.
Query Parameters
github or owner name (like jaebradley is optional)None organization value is provided, the repository name will not be applied to the searchJavascript)There will be a selection of matching code fragments that are returned - these code fragments are searchable. When a code fragment is selected with return key down, the file associated with that code fragment will be opened in your default browser.
Unfortunately, inquirer.js doesn't deal with multiline list choices very well (especially when it comes to arrow key navigation). This is a known issue that this PR hopes to tackle.
Example
Search for instances of jaebradley across GitHub in Javascript files

Search for instances of jaebradley in the jaebradley/textstyler repository across Javascript files

Other search functionality (like searching issues or pull requests are forthcoming).
FAQs
GitHub Searcher from the command line
We found that github-searcher-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.