
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@enymo/react-socket-hook
Advanced tools
A simple hook providing a declarative syntax for listening to websocket events using socket.io
This library was mainly created for use with the React Resource Hook, but can be used by itself nevertheless.
The library may be installed from npm using
npm i @enymo/react-socket-hook
In order to use the useSocket hook in your components, you app has to be wrapped with the SocketProvider to configure the hook
import { SocketProvider } from "@enymo/react-socket-hook";
import React from "react";
import { io } from "socket.io-client";
function App() {
const client = io("https://www.example.com");
return (
<SocketProvider value={client}>
{/* your app here */}
</SocketProvider>
)
}
You can then listen to socket events in your components like this:
import React from "react";
import useSocket from "@enymo/react-socket-hook";
export default function Component() {
useSocket("event", (payload: any) => {
// do something with payload
}, []);
return null;
}
FAQs
React hook for interacting with a socket.io server
We found that @enymo/react-socket-hook demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.