
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@amplitude/react-scripts
Advanced tools
This package includes scripts and configuration used by Create React App.
Please refer to its documentation:
We chose to use react-scripts for lightning's build system instead of custom webpack, babel, and jest configs. We used to have separate configs for each of these, but it was very difficult to keep up-to-date. react-scripts allows us to more-easily update our build system with the "latest and greatest" tech, as well as serve as a forcing function for us to follow common conventions with the general React community.
Unfortunately, we cannot use vanilla react-scripts. We considered some other alternatives, including react-app-rewired and ejecting, but both of those come at some negative traceoffs. react-app-rewired relies on hacking node's module loading mechanism to change behavior of react-scripts, which is brittle, and also limiting in that it only enables some specific overrides. Ejecting is not great either, because it means we'll diverge from create-react-app and we'll end up in the same situation in only a few months later.
So instead, we have decided to fork react-scripts. This comes at the tradeoff that we'll need to do some extra work to handle merge conflicts whenever we update from upstream. It's even more tricky because we'd like to keep this project in the same monorepo as our other JavaScript projects. Even considering these issues, we still feel this solution offers the best solution.
See the accompanying MODIFICATIONS.md for a list of things we changed from the original react-scripts.
The following are instructions for how to update this fork of react-scripts using a git feature called git subtree
. These instructions were adapted from this gist.
First, choose the release you'd like to update to. Go to the create-react-app releases GitHub page to choose the latest release. You'll use this version number in the instructions below in place of "XX.XX.XX".
javascript
repo: e.g. cd $AMP_REPO_ROOT && git clone git@github.com:facebookincubator/create-react-app.git
.cd create-react-app
git checkout vXX.XX.XX
git subtree split -P packages/react-scripts -b react-scripts-vXX.XX.XX
cd
into this repo: cd $AMP_REPO_ROOT/javascript
git remote add react-scripts-source ../create-react-app
git subtree add -P path/to/react-scripts/in/your/repo react-scripts-source react-scripts-vXX.XX.XX --squash
git checkout master && git subtree split -P packages/react-scripts -b react-scripts-vXX.XX.XX
.cd
into this repo: cd $AMP_REPO_ROOT/javascript
git subtree pull
to merge the changes: git subtree pull -P packages/react-scripts react-scripts-source react-scripts-vXX.XX.XX --squash
--squash
?When we add --squash
to the command (as suggested), it means that all the commits done to the original package will be squashed into a single commit when merging into your own repo. This means that your git log
will only show whatever commits you've made in the repo, a squash commit showing what commits where squashed into one + a merge commit whenever you merge.
FAQs
Configuration and scripts for Create React App.
We found that @amplitude/react-scripts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.