
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the projectβs GitHub releases.
@devlander/rawstack-axios-module
Advanced tools
A module used for the raw outdoors with endpoints and types
| What You Want | What to Install | What NOT to Install |
|---|---|---|
| React/Next.js App | @devlander/rawstack-axios-react | β @devlander/rawstack-axios-module |
| React Native App | @devlander/rawstack-axios-react-native | β @devlander/rawstack-axios-module |
| Node.js App | @devlander/rawstack-axios-node | β @devlander/rawstack-axios-module |
This repository contains SEPARATE npm packages for different platforms.
npm install @devlander/rawstack-axios-module # WRONG!
# For React/Next.js apps
npm install @devlander/rawstack-axios-react
# For React Native apps
npm install @devlander/rawstack-axios-react-native
# For Node.js apps
npm install @devlander/rawstack-axios-node
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β THIS REPOSITORY β
β (rawstack-axios-module) β
β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
β β REACT β β REACT NATIVEβ β NODE β β
β β PACKAGE β β PACKAGE β β PACKAGE β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
βββββββββββββββββββββββ¬ββββββββββββββββββββββββββββββββββββββββ
β
βΌ
βββββββββββββββ
β npm β
β REGISTRY β
βββββββββββββββ
β
βΌ
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
β DEPENDENT PROJECTS β
β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
β βrawoutdoors- β βrawoutdoors- β βrawoutdoors- β β
β β nextjs β β mobile-app β βnodejs-api β β
β βββββββββββββββ βββββββββββββββ βββββββββββββββ β
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ
Changes ONLY flow DOWNWARD: This Repo β npm β Dependent Projects NEVER upward: Dependent Projects β This Repo
This repository is ISOLATED and serves as the single source of truth for all API client functionality.
All changes must flow FROM this repository β npm β dependent projects, NEVER the other way around.
The only way to get npm support for this package or create tickets for the original developers to help is to:
Premium members get:
Join the Discord Community β
π Support Channel: @devlander/rawstack-axios-module Support
This monorepo provides separate packages for different platforms:
npm install @devlander/rawstack-axios-react
npm install @devlander/rawstack-axios-react-native
npm install @devlander/rawstack-axios-node
Each platform package has different peer dependencies:
@devlander/rawstack-axios-react)npm install @tanstack/react-query axios react react-dom
@devlander/rawstack-axios-react-native)npm install @tanstack/react-query axios react-native
@devlander/rawstack-axios-node)npm install axios
React/Next.js:
import { ApiClientFactory } from '@devlander/rawstack-axios-react';
React Native:
import { ApiClientFactory } from '@devlander/rawstack-axios-react-native';
Node.js:
import { ApiClientFactory } from '@devlander/rawstack-axios-node';
// Initialize once at app startup - this is a singleton
ApiClientFactory.initialize({
baseUrl: 'https://api.therawoutdoors.com',
keyIdentifier: 'your-key-identifier',
tokenKey: 'your-token-key',
debug: false, // Set to true for development
// Storage functions for token management
saveToStorage: (key, value, identifier) => {
localStorage.setItem(${identifier}_${key}, value);
},
getFromStorage: (key, identifier) => {
return localStorage.getItem(${identifier}_${key});
},
removeFromStorage: (key, identifier) => {
localStorage.removeItem(${identifier}_${key});
}
});
// β All hooks and services now use the same base URL and configuration // β TypeScript-safe: Can't be initialized twice // β Runtime-safe: Throws error if not initialized before using hooks
### 2. Set up React Query Provider
```typescript
import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
const queryClient = new QueryClient();
function App() {
return (
<QueryClientProvider client={queryClient}>
{/* Your app components */}
</QueryClientProvider>
);
}
All hooks automatically use the same base URL and configuration:
// Import from your platform package
import { useGetCurrentUser, useLoginUser, useGetVideosWithLimit } from '@devlander/rawstack-axios-react';
// or
import { useGetCurrentUser, useLoginUser, useGetVideosWithLimit } from '@devlander/rawstack-axios-react-native';
// or
import { useGetCurrentUser, useLoginUser, useGetVideosWithLimit } from '@devlander/rawstack-axios-node';
function MyComponent() {
// β
All these hooks use the same base URL and configuration
const { data: user } = useGetCurrentUser();
const { data: videos } = useGetVideosWithLimit(10);
const loginMutation = useLoginUser();
// β
TypeScript-safe: Will throw error if not initialized
// β
All requests go to the same base URL
// β
All use the same authentication and storage configuration
return (
<div>
<h1>Welcome, {user?.data?.name}!</h1>
<p>Videos: {videos?.data?.videos?.length}</p>
</div>
);
}
// Initialize once
ApiClientFactory.initialize(config);
// All hooks use the same config automatically
const user = useGetCurrentUser(); // Uses same baseUrl
const videos = useGetVideosWithLimit(10); // Uses same baseUrl
const search = useSearchBarQuery('query', 10); // Uses same baseUrl
// β This will throw a clear error if not initialized
const user = useGetCurrentUser();
// Error: "API client not initialized. Call ApiClientFactory.initialize() first."
// β
Check if ready before using
if (ApiClientFactory.isReady()) {
const user = useGetCurrentUser();
}
// β Missing required fields will throw at initialization
ApiClientFactory.initialize({
baseUrl: 'https://api.example.com'
// Error: "keyIdentifier is required"
// Error: "tokenKey is required"
});
// β
All required fields validated at startup
ApiClientFactory.initialize({
baseUrl: 'https://api.example.com',
keyIdentifier: 'my-app',
tokenKey: 'auth-token'
});
// Update base URL for all services at runtime
ApiClientFactory.updateBaseUrl('https://staging-api.example.com');
// All subsequent requests use the new base URL
const user = useGetCurrentUser(); // Uses new baseUrl
const videos = useGetVideosWithLimit(10); // Uses new baseUrl
useGetCurrentUser() - Get current useruseGetUserByID(id) - Get user by IDuseLoginUser() - Login mutationuseRegisterUser() - Registration mutationuseLogoutUser() - Logout mutationuseGetVideoByID(id) - Get video by IDuseGetVideosWithLimit(limit) - Get videos with limitusePostCreateVideo() - Create video mutationuseSearchBarQuery(query, limit) - Search across all contentuseSearchVideoQuery(query, limit) - Search videos onlyuseSearchUsersQuery(query, limit) - Search users onlyuseGetWatchlist(profileId, params) - Get user's watchlistuseAddToWatchlist() - Add to watchlist mutationuseRemoveFromWatchlist() - Remove from watchlist mutationuseGetFeaturedVideos() - Get all featured videosuseGetFeaturedProducers() - Get all featured producersuseGetFeaturedByType(contentType, page?, limit?) - Get featured by typeuseGetFeaturedById(id) - Get featured by IDuseCreateFeatured() - Create new featured mutationuseUpdateFeatured() - Update featured mutationuseDeleteFeatured() - Delete featured mutationuseGetAvailableAvatars() - Get all available avatarsuseGetAvatarById(id) - Get avatar by IDuseCheckShowPreferenceStatus(profileId, contentId, contentType) - Check preference statususeCreateShowPreference() - Create preference mutationuseRemoveShowPreference() - Remove preference mutationuseGetGearByID(id) - Get gear by IDuseGetGearByLimit(limit) - Get gear with limitusePostCreateGear() - Create gear mutationuseGetProducerById(id) - Get producer by IDuseGetProducersWithStart(start) - Get producers with paginationusePostCreateProducer() - Create producer mutationuseSendResetPasswordLink(email) - Send password reset emailbaseUrl: The base URL for your API (used by ALL hooks and services)keyIdentifier: Unique identifier for your applicationtokenKey: Key used for storing authentication tokensdebug: Enable debug mode (default: false)saveToStorage: Function to save data to storagegetFromStorage: Function to retrieve data from storageremoveFromStorage: Function to remove data from storageerrorLogger: Custom error logging functionThe package requires storage functions for token management. Here are examples for different platforms:
{
saveToStorage: (key, value, identifier) => {
localStorage.setItem(`${identifier}_${key}`, value);
},
getFromStorage: (key, identifier) => {
return localStorage.getItem(`${identifier}_${key}`);
},
removeFromStorage: (key, identifier) => {
localStorage.removeItem(`${identifier}_${key}`);
}
}
import AsyncStorage from '@react-native-async-storage/async-storage';
{
saveToStorage: async (key, value, identifier) => {
await AsyncStorage.setItem(`${identifier}_${key}`, value);
},
getFromStorage: async (key, identifier) => {
return await AsyncStorage.getItem(`${identifier}_${key}`);
},
removeFromStorage: async (key, identifier) => {
await AsyncStorage.removeItem(`${identifier}_${key}`);
}
}
All hooks include built-in error handling. Errors are logged to the console by default, but you can provide a custom error logger:
ApiClientFactory.initialize({
// ... other config
errorLogger: (error, context) => {
// Your custom error logging
console.error(`[${context}]`, error);
// Send to your error tracking service
// Sentry.captureException(error);
}
});
The package includes full TypeScript support with comprehensive type definitions for all endpoints, responses, and hooks.
When you need to change API client functionality, you MUST follow this exact process:
# 1. Clone this repository
git clone https://github.com/Devlander-Software/rawstack-axios-module.git
# 2. Make your changes to the source files
# 3. Test your changes
npm test
# 4. Build all packages
npm run build
# 5. Publish updated packages to npm registry
npm run publish:all
# OR publish individual packages:
npm run publish:react
npm run publish:react-native
npm run publish:node
# 6. In EACH dependent project, update the package:
cd rawoutdoors-nextjs
npm update @devlander/rawstack-axios-react
cd rawoutdoors-mobile-app
npm update @devlander/rawstack-axios-react-native
cd rawoutdoors-nodejs-express-api
npm update @devlander/rawstack-axios-node
Please refer to the project's contribution guidelines for information on how to contribute to this package.
Remember: This repository is isolated. Never import from or export to other repositories.
This repository serves the following projects in the Raw Outdoors ecosystem:
@devlander/rawstack-axios-reactnpm install @devlander/rawstack-axios-react@devlander/rawstack-axios-react-nativenpm install @devlander/rawstack-axios-react-native@devlander/rawstack-axios-nodenpm install @devlander/rawstack-axios-nodeAll changes to API client functionality MUST be made in THIS repository, then published to npm, then updated in the dependent projects.
# WRONG - This will break your app!
npm install @devlander/rawstack-axios-module
# RIGHT - Use the platform-specific package
npm install @devlander/rawstack-axios-react # For React/Next.js
npm install @devlander/rawstack-axios-react-native # For React Native
npm install @devlander/rawstack-axios-node # For Node.js
# WRONG - Don't edit these files directly!
cd rawoutdoors-nextjs
# Editing files here won't help - they get overwritten on npm install
# RIGHT - Edit files in THIS repository, then publish to npm
cd rawstack-axios-module
# Make changes here, then publish, then update dependent projects
// WRONG - This creates circular dependencies!
import { something } from '../rawoutdoors-nextjs/src/components'
// RIGHT - All imports should be from npm packages or this repository
import { useApiClient } from '@devlander/rawstack-axios-react'
ISC
FAQs
A module used for the raw outdoors with endpoints and types
We found that @devlander/rawstack-axios-module demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the projectβs GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.