
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@foldkit/devtools
Advanced tools
The in-browser DevTools overlay for Foldkit.
The overlay displays every Message flowing through your app and lets you inspect the Model, Message, Commands, and Mounts at any point in time. Time-travel mode rewinds the UI to any past Model, Inspect mode browses snapshots without pausing the app, and Submodel drill-in scopes the Message list to a nested module. It renders inside a shadow DOM, so it won't interfere with your styles or layout.
pnpm add @foldkit/devtools
# or
npm install @foldkit/devtools
# or
yarn add @foldkit/devtools
@foldkit/devtools lists foldkit, @foldkit/ui, and effect as peer dependencies, so install those alongside it.
The overlay is opt-in. Pass its overlay factory as devTools.overlay when you create the application:
import { Runtime } from 'foldkit'
import { overlay } from '@foldkit/devtools'
const application = Runtime.makeApplication({
// ...
devTools: { Message, overlay },
})
Runtime.run(application)
Without the overlay, a devTools config on its own still records Message history and serves the WebSocket bridge that the DevTools MCP server connects to. Installing @foldkit/devtools and passing overlay is what mounts the visual panel in the browser.
See the DevTools documentation for the full configuration surface.
MIT
FAQs
In-browser DevTools overlay for Foldkit applications
The npm package @foldkit/devtools receives a total of 7,320 weekly downloads. As such, @foldkit/devtools popularity was classified as popular.
We found that @foldkit/devtools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.