
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@guardian/braze-components
Advanced tools
A library of React components for displaying Braze messages on DCR and frontend.
Braze messages are exposed in two ways to address two separate use cases.
One-shot messages use Braze's in-app messages to show a user a single message impression. This is analagous to an ad impression. As with ads, these messages are often competing with other systems for shared message slots on the page. These messages are exposed by the BrazeMessages class.
Persistent notifications are backed by Braze content cards. These notifications persist until they are dismissed (automatically or by the user), or they expire. Notifications from different sources can peacfully co-exist. These notifications are exposed by the BrazeCards class.
$ bin/setup
We use Storybook when building components. Run Storybook with:
$ yarn storybook
The Grid image picker integration in Storybook requires auth. If necessary you'll be redirected to the gutools login service. When developing, this means running the login service locally. Often when developing you won't need to use the image picker. In this case you can skip auth entirely by running Storybook like this:
$ STORYBOOK_DISABLE_AUTH=true yarn storybook
This means you won't need to run the login service locally.
Sometimes it's useful to test a braze-components change against a locally running version of a project which uses it, for example DCR.
It is recommended to use yalc
to do this.
Follow the instructions in the yalc README.
$ yarn build
In your local checkout of @guardian/braze-components
, at the root:
$ yalc publish
$ yalc add @guardian/braze-components
For example, for DCR this should be run from within the dotcom-rendering sub-project.
This will update the local package.json with a yalc ref. This is expected, but the change shouldn't be committed.
The steps above should be repeated when you make a change to braze-components
and you want to see it locally. Don't forget to re run yarn build
!
Releasing to NPM is handled with changesets and is performed by CI.
On your feature branch, before merging, run yarn changeset
. This will
interactively ask you what kind of change this is (major, minor, patch) and
allow you to describe the change. Commit the generated changeset file to git and
push to your branch.
When you merge the branch, a version release PR will be automatically opened. When this PR is merged, a new release will be pushed to NPM. The version change will be based on the information in your changeset file. If the version release PR isn't merged straight away, that's fine. Any other PRs with changesets merged in the meantime will cause the release PR to be updated.
Not all PRs require releasing and therefore don't need a changeset. For example a change to the README.
For dotcom-rendering:
checkout
main branch and git pullcheckout -b
to start a new branch for the update PRdotcom-components/dotcom-components/package.json
yarn
to update the yarn.lock file in the DCR rootDCR CODE
(announce first in the P&E/Dotcom CODE Semaphore
chat) and deploy code there.For frontend:
checkout
main branch and git pullcheckout -b
to start a new branch for the update PRmake install compile
to update dependency lock fileFrontend CODE
(announce first in the P&E/Dotcom CODE Semaphore
chat) and deploy code there.Whenever you push to GitHub actions will be triggered to run Jest tests, the
TypeScript compiler etc. A TeamCity build will also be triggered. On the main
branch if the TeamCity build is successful Riff Raff will deploy Storybook to
https://braze-components.gutools.co.uk.
22.2.0
FAQs
React components to render messages from Braze
The npm package @guardian/braze-components receives a total of 886 weekly downloads. As such, @guardian/braze-components popularity was classified as not popular.
We found that @guardian/braze-components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.