Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@instructure/ui-toggle-details
Advanced tools
yarn add @instructure/ui-toggle-details
import React from 'react'
import Portal from '@instructure/ui-toggle-details/lib/components/ToggleDetails'
export default MyToggleDetails = function () {
return (
<ToggleDetails summary="Hello toggle">
<Text>Hello details</Text>
</ToggleDetails>
)
}
The ui-toggle-details
package contains the following:
See the contributing guidelines for details.
5.0.0 (2018-03-29)
The easiest way to upgrade is to run yarn upgrade --scope @instructure
. Once you've done this, make sure
you check the 'BREAKING CHANGES' section below so that you can make those changes as necessary.
After upgrading you should see deprecation warnings in dev and test environments that will help you prepare for future releases (or check out the 'Deprecations' section below). The ui-codemods scripts should make it easy to update your import/require statements to get rid of a lot of the warnings. Note: you'll need to update your package.json file manually to add the new packages.
Note though, that it's not necessary to upgrade everything at once. Depending on the size of your application you may want to upgrade a package (or component) at a time. This is a major release, but in this case it's safe to do that.
ui-core
!We have broken ui-core
into smaller packages like ui-breadcrumb, ui-buttons,
and ui-container. This change is intended to make consuming Instructure UI components easier by
allowing applications to only import and update the packages they need. You're welcome.
FAQs
A styled toggleable, accordion-like component.
The npm package @instructure/ui-toggle-details receives a total of 3,726 weekly downloads. As such, @instructure/ui-toggle-details popularity was classified as popular.
We found that @instructure/ui-toggle-details demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.