
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
The [REDACTED] TrashGuy script, written in NodeJS/Javascript!
For development, you will only need Node.js and a node global package installed in your environment.
Just go on official Node.js website and download the installer.
Also, be sure to have git available in your PATH, npm might need it (You can find git here).
You can install nodejs and npm easily with apt install, just run the following commands.
$ sudo apt install nodejs
$ sudo apt install npm
You can find more information about the installation on the official Node.js website and the official NPM website.
If the installation was successful, you should be able to run the following command.
$ node --version
v12.8.0
$ npm --version
6.10.2
If you need to update npm, you can make it using npm! Cool right? After running the following command, just open again the command line and be happy.
$ npm install npm -g
$ npm install trashguy
Command line:
SOONtm
NodeJS module:
from trashguy import TrashGuy
console.log(TrashGuy('A B C')) # input must be a string
console.log(TrashGuy('📂', '📊', '✉')) # or an array
Node module as iterator:
const { TrashGuy } = require("trashguy")
for (const pos of new TrashGuy('A B C')) {
console.log(pos)
}
Setting custom symbols with keyword arguments and printing as a newline-joined string:
trashAnimation = new TrashGuy(userInput,{
spriteCan:'\u2A06',
spriteLeft:'<(-.- <)',
spriteRight:'(> -.-)>',
spacer:TrashGuy.Symbols.SPACER_EMOJI,
wrapper:TrashGuy.Symbols.WRAPPER_BLOCK_MONO}) # triple backticks
console.log(trashAnimation) # outputs entire animation with each frame separated by newline
⭐ Star the repository and share with your friends! ⭐
Feel free to donate so we can get some marshmallows 😁
FAQs
The [REDACTED] TrashGuy script, written in Javascript!
The npm package trashguy receives a total of 0 weekly downloads. As such, trashguy popularity was classified as not popular.
We found that trashguy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.