
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A little wrapper over LittleCMS utilities.
You need to have LittleCMS installed. You can build it from source by following these steps (which should work on Unix-based systems, including macOS):
git clone git@github.com:mm2/Little-CMS.git
cd Little-CMS
./configure
make
make check
make install
You can now use node-lcms in your project by installing it from npm into your project:
# using npm
npm install node-lcms
# using yarn
yarn add node-lcms
convert(options = {}) → function(color_arr)This is a wrapper over the Little CMS's transicc utility, which converts colors based on ICC profiles.
let { convert } = require('node-lcms');
let conv = convert({
profile_out: require.resolve('color-profiles/pso-coated-v3.icc')
});
console.log(conv([255, 0, 0]));
intent:
| Value | Description |
|---|---|
0 | Perceptual |
1 | Relative colorimetric |
2 | Saturation |
3 | Absolute colorimetric |
10 | Perceptual preserving black ink |
11 | Relative colorimetric preserving black ink |
12 | Saturation preserving black ink |
13 | Perceptual preserving black plane |
14 | Relative colorimetric preserving black plane |
15 | Saturation preserving black plane |
Built-in profiles:
| Profile | Description |
|---|---|
*Lab2 | D50-based v2 CIELab |
*Lab4 | D50-based v4 CIELab |
*Lab | D50-based v4 CIELab |
*XYZ | CIE XYZ (PCS) |
*sRGB | sRGB color space |
*Gray22 | Monochrome of Gamma 2.2 |
*Gray30 | Monochrome of Gamma 3.0 |
*null | Monochrome black for all input |
*Lin2222 | CMYK linearization of gamma 2.2 on each channel |
This project is indebted to James Pederson's node-transicc for instructions on how to install LittleCMS from source and how to interface with it in Node.js.
FAQs
A little wrapper over [LittleCMS](https://github.com/mm2/Little-CMS) utilities.
We found that node-lcms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.