
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ecodrix/richtext
Advanced tools
# 🧠 @ecodrix/richtext
A lightweight, modular **Rich Text Editor** for React and Next.js — powered by an isolated iframe runtime for true sandboxed editing.
---
## ⚙️ Installation
Install using your preferred package manager:
```bash
npm install @ecodrix/richtext
# or
yarn add @ecodrix/richtext
# or
pnpm add @ecodrix/richtext
```
The package includes built-in Tailwind-based styles.
You must import them once in your global layout (e.g. layout.tsx or _app.tsx):
import "@ecodrix/richtext/styles";
💡 Make sure your Tailwind setup is working — these styles rely on TailwindCSS utilities.
Here’s the simplest way to use the rich text editor in your React or Next.js project:
"use client";
import React from "react";
import { RichtextEditor } from "@ecodrix/richtext";
export default function Example() {
return (
<RichtextEditor
initialContent="<p>Hello, world!</p>"
onChange={(editor) => {
console.log("HTML Output:", editor.toHTML());
console.log("JSON Output:", editor.toJSON());
}}
/>
);
}
To include the built-in toolbar with text formatting, headings, alignment, and lists:
"use client";
import React from "react";
import { RichtextEditor } from "@ecodrix/richtext";
export default function EditorWithToolbar() {
return (
<RichtextEditor
initialContent="<h2>Start typing...</h2><p>This is a sandboxed editor.</p>"
toolbar={{ format: true }}
onChange={(editor) => {
console.log(editor.toHTML());
}}
/>
);
}
You can easily get both HTML and structured JSON:
onChange={(editor) => {
const html = editor.toHTML();
const json = editor.toJSON();
console.log("HTML:", html);
console.log("JSON:", JSON.stringify(json, null, 2));
}}
By default, the editor body is styled with:
body {
font-family: system-ui, -apple-system, sans-serif;
line-height: 1.6;
color: #111;
background: #fff;
padding: 0.75rem;
}
blockquote {
border-left: 3px solid #ddd;
padding-left: 1em;
color: #555;
}
pre {
background: #f6f6f6;
padding: 0.6em;
border-radius: 6px;
}
To customize further, wrap the editor in your own styled container:
<div className="border border-gray-300 rounded-md shadow-sm p-2 bg-white">
<RichtextEditor initialContent="<p>Custom styled editor</p>" />
</div>
If you want direct access to the editor core (e.g. to run commands or serialize manually):
import React, { useRef } from "react";
import { RichtextEditor, useEditor } from "@ecodrix/richtext";
export default function ControlledEditor() {
const { core } = useEditor();
const handleSave = () => {
if (core) {
console.log(core.toHTML());
}
};
return (
<>
<RichtextEditor initialContent="<p>Edit here...</p>" />
<button onClick={handleSave}>Save</button>
</>
);
}
editor.chain.bold().run())editor.chain.bold().italic().underline().run();
editor.chain.heading(2).run();
editor.chain.alignCenter().run();
editor.chain.insertTable(3, 4).run();
editor.chain.color("#ff0077").run();
editor.toHTML() or editor.toJSON() for database storage# Build package
npm run build
# Run local dev (Next.js demo)
npm run dev
# Publish to npm
npm publish --access public
MIT License © 2025 ECOD You are free to use, modify, and distribute this package under open source license.
---
Would you like me to add a small **“Next.js setup snippet”** (showing how to import Tailwind + styles into `layout.tsx` and ensure client-only rendering)?
That’s usually the final piece for smooth usage in production.
FAQs
A modular rich text editor with toolbar and iframe support.
The npm package @ecodrix/richtext receives a total of 0 weekly downloads. As such, @ecodrix/richtext popularity was classified as not popular.
We found that @ecodrix/richtext demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.