
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@dynamico/core
Advanced tools
A framework agnostic client for fetching and evaluating remote dynamic components
$ yarn add @dynamico/core
The client must define the registry end-point, components delegated depedencies, and cache and optionally control much more.
import { dependencies as hostVersions } from './package.json';
const dynamico = new DynamicoClient({
url: '/api/components',
dependencies: {
versions: hostVersions,
resolvers: {
react: React
}
},
cache: localStorage
});
Note: in react, the client is provided through react context to the components loader
url
string
Registry url
Best Practice: proxy the request through your server to the dynamico registry server in order to prevent CORS
depedencies
Record<string, string>
Host application dependencies versions. This is a crucial information for the dynamico registry in order to resolve the best available dynamic component version.
Record<string, any>
The delegated and shared depedencies we pass to the evaluation of the component.
Dynamic comonents should always try to share it's depedencies with it's host application.
cache
StorageController
A cache storage for storing fetched components for offline usage and memoization
Best Practice: use the default storage such as localStorage or AsyncStorage
fetcher - (optional)
GlobalFetch['fetch']
The fetcher that the client should use. This has to conform to the browser's fetch
API.
By default the client will look for the global window.fetch
. For other environments you can use node-fetch
Best Practice: Use this property if you want to use a different HTTP client or you do SSR
globals - (optional)
Record<string, any>
A way to expose global variables on the evaluated component
dynamico.get('MyComponent', options);
As the name implies, these are all optional:
componentVersion
string
Force the client to provide the component at a specific version and skip the normal resolution strategy.getLatest
boolean
Skip local cache lookup and index and go straight to the server to fetch the latest component's code.globals
Record<string, any>
Additional globals you would like to expose in the context of this specific component's evaluation.export interface DevOptions {
dependencies: {
versions: Record<string, string>,
resolvers: Record<string, any>
};
callback: Function;
interval?: number;
urlOverride?: string;
}
const dynamicoDev = new DynamicoDevClient({
dependencies: {
versions: hostVersions,
resolvers: {
react: React
}
},
callback: view => RenderComponent(view) // Render the component to the screen
});
The dev client extends the basic client and enables a live reload development experience by polling a local development server.
dependencies.versions and dependencies.resolvers are the same as at the regular client
Function
A callback function that's called everytime the remote code has changed
Note: Use this function to commit the code changes (i.e. in React, trigger the render function)
number
1000
milliseconds.The polling mechanisem interval - time in milliseconds.
urlOverride - (optional)
string
DYNAMICO_DEVELOPMENT_SERVER
environment variable or http://localhost:8383
The dev repository url
dynamicoDev.get('MyComponent', options);
Supported options are the same as regular client options.
FAQs
Dynamico core library
The npm package @dynamico/core receives a total of 0 weekly downloads. As such, @dynamico/core popularity was classified as not popular.
We found that @dynamico/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.