Fallout

Recently scanned open-source supply-chain artifacts and public lab uploads.

dotenv 9.0.2 Loads environment variables from .env file 4d ago npm
5ed4ca9289f9fb4448e88d7a7e157876811627449a4d0d6f929a6af5789f146e H(F)Md(Pa₃)
d3-force-3d 3.0.6 Force-directed graph layout in 1D, 2D or 3D using velocity Verlet integration. 4d ago npm
ec4088e86fb1cfa35812d9e162fc09163212a1e6eba2e80ae9f3e4dd615c6c54 H(F)Md(Pa₃)
backport 1.2.0 A pure Ruby library for event-driven IO 35,004,780 installs 5d ago gem
912c7dfdd9ee4625d013ddfccb6205c3f92da69a8990f65c440e40f5b2fc7f75 H(F)Md(Pa₃)
atomos 0.1.3 A simple gem to atomically write files 154,751,172 installs 5d ago gem
7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f H(F)Md(Pa₃)
chunkd 2.0.1 Get a chunk of an array based on the total number of chunks and current index 5d ago javascript
5110842dc803a2fadae09c57823deaefd2a20fa393a74de79cd438991c1387f0 H(F)Md(Pa₃)
node-sass-magic-importer 5.3.3 Custom node-sass importer for selector specific imports, node importing, module importing, globbing support and importing files only once Jul 26 npm
0f4edf4dcfa64fe4474dc5e1be0da346ea5d1c8b988a716b14824521a175857a H(F)Md(Pa₃)
openredaction Production-ready PII detection and redaction for JavaScript/TypeScript. Regex-first, local-by-default, 570+ patterns. Jul 26 javascript
2d9262717a799d95b7629555b88ccd04db95310e264f8ffb668738663a6da073 H(F)Md(Pa₃)
@dogsvr/cl-tsrpc TSRPC (WebSocket/HTTP) connection layer for @dogsvr/dogsvr. Jul 26 javascript
5be9ab7d6c013f1d4d7521bbd13395389c49eef92f0b8c15b04a62f08e14c1c8 H(F)Md(Pa₃)
34% Standard npm package build scripts
@langri-sha/monorepo A utility package that helps you resolve paths relative to your monorepo root. Jul 26 javascript
c64e09077a583a4a4e56df0276e7c649aadd28fb06e7a0435614594a0b325a0a H(F)Md(Pa₃)
32% Legitimate monorepo utility package
@bitcoinerlab/descriptors-scure 3.1.7 This library parses and creates Bitcoin Miniscript Descriptors and generates Partially Signed Bitcoin Transactions (PSBTs). It provides PSB… Jul 26 npm
6cf32884188403f47ccb4cd5a18a5ac12ad135be028494d2a9cc8dc248f0c461 H(F)Md(Pa₃)
@av-pi-studio/highlight 0.0.40 Server-side syntax-highlighting helper for Pi-Studio. A pure-JavaScript regex tokeniser — no external highlighting library, and (deliberate… Jul 26 npm
fd5ef0ad0a94c3b2e901a2c0be7a881fa3c4db5a9a67d0985123b0103f50d1a6 H(F)Md(Pa₃)
@sx4im/chronos-vitest 0.1.1 Vitest integration for Chronos: simTest, expectInvariant, replayTest, failure capsules, failure shrinking. Reproduce distributed-systems bu… Jul 25 npm
4933b1b096bf505c7a67aae461a01fa85bb1f6b221ad1fcde23dedf7a8e827fb H(F)Md(Pa₃)
@av-pi-studio/highlight 0.0.31 Server-side syntax-highlighting helper for Pi-Studio. A pure-JavaScript regex tokeniser — no external highlighting library, and (deliberate… Jul 23 npm
0d86d4d1baed0f5a975c5019e6f5ffc50aa7c0cb0b8f6ffa92ef257f70929fe5 H(F)Md(Pa₃)
@wwawing/event-emitter nodeでもモダンブラウザでもIE11でも使えるすごいEventEmitter Jul 23 javascript
8b0f17a3993afc79a242ee6f55fc69c458e6d72de0e8bdce2a77b814222c491d H(F)Md(Pa₃)
80% Publisher not listed as maintainer
@av-pi-studio/highlight Server-side syntax-highlighting helper for Pi-Studio. A pure-JavaScript regex tokeniser — no external highlighting library, and (deliberate… Jul 23 javascript
bef45c777fe151e0b53d83e49aa5fd059c25d8b6d63d21ef6dd4c944eedded8c H(F)Md(Pa₃)
type-fns 1.21.4 A set of types, type checks, and type guards for simpler, safer, and easier to read code. Jul 23 npm
ac8d1ee58fc9276bccb98a1be38f9eb347deb1ef73282c67056cc0e90ab4d9a6 H(F)Md(Pa₃)
@plugjs/cov8 V8 Coverage Plugin for the PlugJS Build System ============================================== Jul 23 javascript
0fd8e33896b9f1aa80f8b7f1b9fd37d7484f2d6d7c7601712b28d2f903e4d921 H(F)Md(Pa₃)
@plugjs/eslint ESLint Plugin for the PlugJS Build System ========================================= Jul 23 javascript
467cd8ebd8832ba4f67c37ee6884d6d7808b5b201c640d55fbe27d61f88e3912 H(F)Md(Pa₃)
@acjlabs/receipt-extraction-client Typed TypeScript client for the ACJ Labs Receipt Extraction MCP server (pf 00002) — call extract_receipt without wiring up a full MCP clien… Jul 22 javascript
056d194b9c38d8f29f4e7bd75129a22dbc686e2c93683100eee91fec72152acd H(F)Md(Pa₃)
39% Legitimate TypeScript client package
@sx4im/chronos-vitest Vitest integration for Chronos: simTest, expectInvariant, replayTest, failure capsules, failure shrinking. Reproduce distributed-systems bu… Jul 22 javascript
8dae917ad7428c50d44e9d306e05814faeced8d72fb22e9b5bcb017b08d46cfd H(F)Md(Pa₃)
@on-the-ground/effect This package exposes small composable helpers for building effect-driven APIs with `AbortSignal` support, typed effect tokens, and proxy-ba… Jul 22 javascript
d8b5cd19e4dbbcf081185882fd185b1b671de027b1649649b5344cb2342e6d94 H(F)Md(Pa₃)
44% Legitimate npm package with standard scripts
@acpus/core Acpus TypeScript Workflow Core: Schema bridge, Acpus Expr IR, zx/core-backed Task command wrapper, authoring DSL, and validator. Jul 22 javascript
0d454eaf09f0c54ba046f99f1945a18b3baa08cb99e2a6ec56bb2b84296b607d H(F)Md(Pa₃)
@0xmonaco/contracts Smart contract ABIs and addresses for the Monaco protocol. This package provides the interface definitions and deployed addresses for all M… Jul 22 javascript
79a337f6d059bc29767b0677cb96502a81c5a403b0003117a5a62aaa61dfd86f H(F)Md(Pa₃)
@av-pi-studio/highlight Server-side syntax-highlighting helper for Pi-Studio. A pure-JavaScript regex tokeniser — no external highlighting library, and (deliberate… Jul 22 javascript
06ee28edaebaf1f2aa60a711e127249d55360aaf42951fabcd8f42688f47e96d H(F)Md(Pa₃)
36% Standard npm package with clean scripts
@urbicon-ui/design-content Version-pinned bundle of Urbicon UI design knowledge — component catalog, per-component llm.txt, design-system principles + patterns, guide… Jul 22 javascript
dad1159db3f744bc340bff82b16b7f45e298fe75066133ef0dabfa681e568b0a H(F)Md(Pa₃)
@av-pi-studio/highlight Server-side syntax-highlighting helper for Pi-Studio. A pure-JavaScript regex tokeniser — no external highlighting library, and (deliberate… Jul 22 javascript
236fc7e187cd5ee50b9e1709110c2dea7b4b1ef61f53d37cdae05d1baf73fcce H(F)Md(Pa₃)
36% Standard npm package with clean scripts
@on-the-ground/effect This package exposes small composable helpers for building effect-driven APIs with `AbortSignal` support, typed effect tokens, and proxy-ba… Jul 22 javascript
873e4fae983f33fb281935be78a83ff6b88ca23540344c17045e0dd9d5c27268 H(F)Md(Pa₃)
@inflowpayai/mpp-seller InFlow MPP SDK: seller-side `inflow` method built as a native mppx server method — challenges are minted and HMAC-bound locally by mppx, wh… Jul 22 javascript
4e8909d51c3535710c7f4224ee462873593667dcaf36dd2e546d69678da71408 H(F)Md(Pa₃)