
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Heco provide a set of commands to install, configure and manage your Hadoop Ecosystem. At the moment, it is focusing on local developer installation.
git clone http://github.com/wdavidw/heco.git
cd heco
npm install
npm link
heco help
heco install
On OSX, I didn't encounter any particular issue, but maybe was it because I already had all the dependencies.
On a fresh Ubuntu 11.04 installation, you will need to prepare the system as follow.
# Install Sun Java JDK (recommended by Hadoop)
UBUNTU_REPO='deb http://archive.canonical.com/ubuntu maverick partner'
sudo echo $UBUNTU_REPO > /etc/apt/sources.list.d/ubuntu_partner.list
sudo echo 'export JAVA_HOME=/usr/lib/jvm/java-6-sun' > /etc/profile.d/java.sh
sudo apt-get update
sudo apt-get install sun-java6-jdk
# For Hive and Hue
sudo apt-get install mysql-server
# For Hue
sudo apt-get install python2.7-dev
sudo apt-get install libxslt-dev
sudo apt-get install libmysqlclient-dev
sudo apt-get install libsqlite3-dev
sudo apt-get install libsasl2-dev
sudo apt-get install maven2
sudo apt-get install asciidoc
On Ubuntu 11.10, Hue installation failed, see: https://issues.cloudera.org/browse/HUE-599?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel#issue-tabs
FAQs
Hadoop Ecosystem
We found that heco demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.