
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Return whether a directory is a subdirectory of another directory
Cross-platform. Works correctly on Windows, where directory paths can start with disk drive letters in different casings. Like c:\foo and C:\foo\bar.
Returns true when the directories match. The isSubdir.strict() variant only returns true if the second parameter is a strict subdir of the first and not the same.
<npm|yarn|pnpm> add is-subdir
'use strict'
const path = require('path')
const isSubdir = require('is-subdir')
console.log(isSubdir(process.cwd(), path.resolve('node_modules')))
//> true
console.log(isSubdir.strict('node_modules/tape', '../tape'))
//> false
isSubdir(parentDir, subdir): booleanisSubdir.strict(parentDir, subdir): booleanThe path-is-inside package provides similar functionality by checking if one path is inside another path. It is useful for validating file paths and ensuring that a given path is within a certain directory. Compared to is-subdir, path-is-inside offers a more general approach to path validation.
The is-path-inside package checks if a path is inside another path. It is similar to is-subdir but focuses on paths rather than directories specifically. This package is useful for ensuring that a file or directory is within a certain path, providing a broader use case compared to is-subdir.
FAQs
Return whether a directory is a subdirectory of another directory
The npm package is-subdir receives a total of 2,382,481 weekly downloads. As such, is-subdir popularity was classified as popular.
We found that is-subdir demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.