
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A smart data caching library with automatic refresh and race condition handling for Node.js applications. nw-loader ensures efficient data loading with minimal redundant requests while maintaining data freshness.
On high-concurrency web servers, there are two common scenarios that can cause multiple requests to be passed to the backend:
When either of these scenarios occurs, if multiple requests arrive simultaneously, a poorly designed caching service will cause each request to check the cache, find no cached data, and then all request the backend data. This causes a sudden spike in backend pressure.
When using NWLoader, you get:
NWLoader will request backend data in the background to update the cache.The final effect is that if the TTL is set to 30 seconds, using NWLoader will ensure that backend data requests occur only once within 30 seconds.
npm install nw-loader
Note: You need to install a Redis client library in your project (e.g., ioredis or node-redis).
const NWLoader = require('nw-loader');
// You need to install a Redis client library in your project, e.g., ioredis
const Redis = require('ioredis');
const redis = new Redis('redis://127.0.0.1:6379'); // Create your Redis client instance
const loader = new NWLoader('user', function(user_id) {
return db.getUser(user_id);
}, {
redis: redis // Pass the Redis client instance
});
//...
router.get('/getUser', async ctx => {
ctx.body = await loader.load(ctx.query.user_id);
});
//...
import { cacheable } from 'nw-loader';
// You need to install a Redis client library in your project, e.g., ioredis
import Redis from 'ioredis';
const redis = new Redis('redis://127.0.0.1:6379');
export const getName = cacheable('redis:key:name', { redis: redis, ttl: 3 })(async (id, language) => {
console.log('real getting name: ' + id + ' ' + language);
return language+':' + id;
});
getName(1, 'en').then(console.log); //en:1
getName(1, 'cn').then(console.log); //cn:1
const loader = new NWLoader(name, loadFunction, options)
name (string): Unique identifier for this loader instanceloadFunction (function): Async function that loads data when not in cacheoptions (object): Configuration options{
// Requires a Redis-like instance with set, get, del, and createScript methods
redis: null, // Redis client instance (mandatory)
// Default expiration seconds
// If you request data after this time, nw-loader will return cached
// data immediately, then request real data to update cache in background
// ttl should greater than 3 seconds for best practice
ttl: 30,
// Prefix for every key
keyPrefix: 'nwloader'
}
load(...args): Load data using the loader function, with cachingclear(key): Clear cached data for a specific keyprime(key, value): Manually populate cache with datarequire('nw-loader').cacheable(name, options)(loadFunction)
Note: The cacheable decorator also requires a redis instance in its options.
nw-loader implements a sophisticated cache refresh strategy:
2 * userTTL in RedisThis approach ensures:
You need to ensure your Redis server is available. NWLoader has no ability to handle extreme situations. You need to handle Redis errors yourself. If the Redis server fails, an error will be thrown when calling the loader.load() method.
If your data fetching method has errors, there are two scenarios:
loader.load() method.NWLoader encounters an error when updating in the background, NWLoader will call console.error to log the error. In this case, your program will continue running for another TTL seconds, and only then will the loader.load() method catch the error.npm i --dev
npm test
MIT
FAQs
data cache with refresh lock
We found that nw-loader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.