
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@concord-consortium/react-components
Advanced tools
Intended to be used as a common repository for reusable UI widgets.
This project was set up in the Fall of 2019. It followed this Design Systems for Developers tutorial.
Typescipt was used intstead of plain JS. It was bootstrapped with Create React App:
npx create-react-app concord-react-components --typescript
This project is audomatically deployed to https://storybook.concord.org/ via github Netlify integration
yarn install from the project root.yarn run storybook from the project root.src/components/stories/index.tsconcord-react-components in your project's package.json file, and import-ing them.concord-react-components to your working checkout by using
npm link from the projects top directory.npm link concord-react-components from the target apps top directory. Remember
to remove the link, and link to actual NPM package later. The best practice when doing
this sort of work is probably to remove node_modules and do a clean install of
concord-react-components from npm.yarn does not seem to be used anymore, the following instructions need to be updated.
yarn build to build ./distpackage.json adhering to semver. If the
release number is less than 1.0 then no promises are made. Otherwise if a components
property changes in an incompatible way, bump the major version number. New components
can simply bump the minor version number.yarn publish to push changes up to npmYou can convert SVG files into react functional components by using the
svgr command line tool. eg:
cd source-icons
npx @svgr/cli --icon --out-dir ../src/components/svgr-icons --template ../svgr.config.js --ext tsx *.svg
In the project directory, you can run:
yarn run storybookRuns the storybook component browswer on a local port.
yarn run buildBuilds the dist folder for publishing to NPM
yarn publishWill publish the dist folder to NPM.
yarn run ejectNote: this is a one-way operation. Once you eject, you can’t go back!
2019-11-07 NP: It seems like we have no need for this linkage. We should consider ejecting.
This project was originally setup using:
npx create-react-app concord-react-components --typescript
If you aren’t satisfied with the build tool and configuration choices, you can eject at any time. This command will remove the single build dependency from your project.
Instead, it will copy all the configuration files and the transitive dependencies (Webpack, Babel, ESLint, etc) right into your project so you have full control over them. All of the commands except eject will still work, but they will point to the copied scripts so you can tweak them. At this point you’re on your own.
FAQs
An assorted collection of components
We found that @concord-consortium/react-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.