
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@increase/typed-components
Advanced tools
UI components and elements used throughout Increase platform.
UI components and elements used throughout Increase platform.
This project is a collection of components, utilities, types and others made 100% in TypeScript. The usual development flow involves starting a Storybook server which serves as a playground for the components in the library and start hacking in a new or existent element in the src folder. It is possible to work on a component without making use of Storybook at all by setting up an npm link (more notes on that below).
This project is prepared to run tests using the power of Jest and its snapshots. Please refer to the docs or inspect the tests folders to get an idea of how they work.
As part of the build process ESLint is run, and errors and unsatisfied linting rules do break the build. It is highly recommended to use VSCode with the settings described below.
First you need to make sure you are using the node version specified in the .nvmrc file. This is very important in case you want to develop a new component using npm link to test it directly in your host project. Run nvm use to switch to the version this project needs. After that, you only need to run npm ci to install the project.
nvm use && npm ci
Why npm ci and not npm start? As this project relies on React and some other peer dependencies, it is safer to use npm ci, which uses the package-lock.json file to download dependencies that in turns adheres to the versions defined in this file. That means that all the developers in the team will share exactly the same versions of all the dependencies in the project. Save npm install for cases in which you need to install new dependencies and when you DO want to modify the package-lock.json.
The most usual way to develop is to run the Storybook server and add new stories here, which will make use of your component. For this, just run npm run storybook. The dev server will start and you can use the other components currently present as a reference to start a new one.
If your component is new, you only have to create a __tests__ folder to start adding tests. Whenever your tests are run for the first time, Jest will create snapshots with the output of such tests. Read the docs about snapshot testing in Jest's website. There are a few commands related to tests:
npm run test:dev: run existent tests against their previous snapshotsnpm run test:coverage: reports coverage on current code base.npm run test:update: update tests snapshots. Be careful about this one, before commiting your changes to git make sure that you are only updating the snapshots for YOUR tests, otherwise it would mean that you are changing others' components behavior. Refer to jest docs for more information.npm linkYou can test any component in the context of the host project by using npm link.
.nvmrc file and that both versions are the same. This is the most important step, otherwise the link won't work, as the sym link is created within the folder of the current node version.npm link (you'll see that a sym link is created with its path)platform-front). Run nvm use to make sure you are using the proper node version (remember, it needs to be the same version as in this project!).npm link @increase/typed-components.Now you should be able to start the host project. Everytime you make an edition in any of the files of typed-components you could run npm build (slow) or just run once npm build-watch (faster, but keep reading to see the caveats) and code normally.
The difference between npm build and npm build-watch is that the later just runs the TypeScript compiler while the former also copies static files like images from the source folder to the build folder. Unless you are working in a component that relies on the static files (and you are changing those files) the build-watch command should be enough most of the time.
Once your component is finished, you can try that the publishing of the whole library will be succesful and that the import statements from the host project will work as expected (with the types properly exported and so on). To do so, a quick way that does not involves actual publishing to the NPM registry is by the usage of the command npm pack.
# In @increase/typed-components folder
$ npm run build
# ...Wait for above command to be succesful
$ npm pack
This will create a file called something like increase-typed-components-0.0.1.tgz. Put it in your home folder:
$ mv ./increase-typed-components-0.0.1.tgz ~/
Now go to your host project, eg: @increase/platform-front. Open its package.json and remove the @increase/typed-components entry from there. Go to the same folder in your terminal and run the following:
# in platform-front folder
$ rm -rf ./node_modules
$ npm install ~/increase-typed-components-0.0.1.tgz --save-dev
$ npm install
You might want to check that your ./node_modules folder has the dependency installed. VSCode will start showing you errors/suggestions on any TypeScript file in that project that makes use of components in typed-components. Important: for the types to work as expected you must use typed-components from TypeScript files! If your file ends in .js or .jsx rename it to .ts or .tsx (if contains JSX tags). This is not mandatory, though, as components imported from this library will still work (it's just plain JavaScript after all), but you won't have static type checking.
If the library is ready to be published to the NPM Registry, do the following.
master branch.package.json, commit, but DO NOT PUSH YET.npm publish --access=publicgit tag v0.x.x (replace with proper version).git push origin HEAD --tags@increase/typed-components.VSCode is not required to run the project. You can run the code using whatever editor suits you, but the lint warnings and prettier strictness will bother you everytime you try to build the code. To avoid these annoyances, you can set up VSCode with the following settings.
dbaeumer.vscode-eslint)nathanridley.autotrim)andrewrazumovsky.vscode-styled-jsx-languageserver)Cmd + Shift + P and type "Save workspace as").settings section in the workspace file. They will allow the ESLint plugin to validate your code and apply corrections automatically (when possible).Example of a workspace.code-workspace file:
{
"settings": {
"eslint.validate": [
"javascript",
"javascriptreact",
{
"language": "typescript",
"autoFix": true
},
{
"language": "typescriptreact",
"autoFix": true
}
],
"editor.formatOnSave": true,
"editor.renderControlCharacters": true,
"javascript.implicitProjectConfig.checkJs": false,
"editor.renderWhitespace": "all",
"vetur.format.defaultFormatter.js": "prettier-eslint",
"typescript.updateImportsOnFileMove.enabled": "always",
"javascript.format.enable": true,
"typescript.format.enable": true,
"vetur.format.defaultFormatter.ts": "prettier",
"eslint.enable": true,
"javascript.validate.enable": true,
"typescript.validate.enable": true,
"editor.formatOnSave": true
}
}
Most settings are self explanatory but renderWhitespace and renderControlCharacters will help you a lot when Prettier reports whitespace violations. Feel free to make any change, this setup is provided as a reference.
FAQs
UI components and elements used throughout Increase platform.
We found that @increase/typed-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.