
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@cryptocadet/cryptopay-mini
Advanced tools
Minimal payment router for accepting payments on EVM and Solana.
CryptoPay-Mini is minimal payment router for accepting payments on EVM and Solana.
CryptoPay-Mini requires Node.js v18+ to run.
Install the dependencies and devDependencies and start the server.
npm install @cryptocadet/crypto-pay-mini
In order to install for NextJS, the CryptoPay Modal must be imported dynamically:
npm install @cryptocadet/crypto-pay-mini
Create a components folder within your app or src folder, and create a new file.
import {CryptoPayMiniButton} from '@cryptocadet/cryptopay-mini'
const ComponentName = () => {
return (
<CryptoPayMiniButton
apiKey={'YOUR_API_KEY'}
label='BUTTON TITLE'
style={null}
amount={number}
refId={'REFERRER ID'}
method={'method'}
/>
)
}
export default ComponentName;
In your page or index file, dynamically import the created component:
export default function Home() {
const ComponentName = dynamic(() => import("./../components/ComponentName"), { ssr: false });
return (
<ComponentName />
)
React Crypto Pay Button style can be customized by targeting the cryptopaymodal and cryptopaybutton classes and the style tag in JSX. Web3Modal styles can be imported by adding the following in the component file:
import 'crypto-pay-mini/dist/style.css'
MIT
We love your input! We want to make contributing to this project as easy and transparent as possible, whether it's:
FAQs
Minimal payment router for accepting payments on EVM and Solana.
We found that @cryptocadet/cryptopay-mini demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.