
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@iworldafric/timelog
Advanced tools
A production-grade, advanced Time Log system for Next.js applications. Built with TypeScript, React 19, Prisma, and Chakra UI.
npm install @iworldafric/timelog
# or
yarn add @iworldafric/timelog
# or
pnpm add @iworldafric/timelog
The package will automatically run post-install migrations to set up your database schema.
The post-install script will automatically create the necessary Prisma migrations. If you need to run them manually:
npx prisma migrate dev
Create /app/api/time-entries/route.ts:
import { createTimeEntryRoutes } from '@iworldafric/timelog/server/next';
import prisma from '@/lib/prisma';
import { authOptions } from '@/lib/auth';
export const { GET, POST, PUT, DELETE } = createTimeEntryRoutes({
prisma,
authOptions
});
import {
TimeEntryForm,
Timer,
WeeklyTimesheetGrid,
ApprovalQueue,
ProjectTimeChart
} from '@iworldafric/timelog/react';
import { TimelogProvider } from '@iworldafric/timelog/react';
function MyApp() {
return (
<TimelogProvider>
<Timer />
<TimeEntryForm onSubmit={handleSubmit} />
<WeeklyTimesheetGrid
weekStart={new Date()}
entries={entries}
/>
</TimelogProvider>
);
}
The package follows Hexagonal Architecture with clear separation of concerns:
@iworldafric/timelog
├── /core # Domain logic, types, validation, policies
├── /adapters # Prisma repositories
├── /server/next # Next.js route factories
└── /react # React components and hooks
// Core domain logic
import { TimeEntry, RateCard, submitTimeEntries } from '@iworldafric/timelog/core';
// Prisma adapters
import { TimeEntryRepository } from '@iworldafric/timelog/adapters/prisma';
// Next.js server
import { createTimeEntryRoutes } from '@iworldafric/timelog/server/next';
// React components
import { Timer, ApprovalQueue } from '@iworldafric/timelog/react';
import { submitTimeEntries, approveTimeEntries } from '@iworldafric/timelog/core';
// Submit entries for approval
const result = submitTimeEntries({
entries: [entry1, entry2],
context: { userId, userRole, timestamp }
});
// Approve submitted entries
const approved = approveTimeEntries({
entries: submittedEntries,
context: { userId, userRole, timestamp }
});
import { calculateEntryCosts, generateFinanceExport } from '@iworldafric/timelog/core';
// Calculate costs with rate cards
const costs = calculateEntryCosts({
entries,
rateCards,
roundingInterval: RoundingInterval.FIFTEEN_MINUTES
});
// Generate finance export
const export = generateFinanceExport({
entries,
rateCards,
groupBy: 'project'
});
import { createTimeLock, checkEntryLockConflict } from '@iworldafric/timelog/core';
// Create a time lock
const lock = createTimeLock({
projectId: 'project-1',
periodStart: new Date('2024-03-01'),
periodEnd: new Date('2024-03-31'),
reason: 'Monthly closing',
lockedBy: userId
});
// Check for conflicts
const conflict = checkEntryLockConflict(entry, locks);
Track time with start/stop functionality:
<Timer
onStart={handleStart}
onStop={handleStop}
initialMinutes={0}
/>
Editable grid for weekly time entries:
<WeeklyTimesheetGrid
weekStart={monday}
entries={entries}
onCellEdit={handleEdit}
onAddEntry={handleAdd}
/>
Bulk approval interface:
<ApprovalQueue
items={submittedEntries}
type="entries"
onApprove={handleApprove}
onReject={handleReject}
showStats={true}
/>
Visual analytics with Recharts:
<ProjectTimeChart data={projectData} height={300} />
<DeveloperHoursChart data={developerData} showLegend />
The system applies rates in the following order:
NONE: No roundingONE_MINUTE: Round to nearest minuteFIVE_MINUTES: Round to nearest 5 minutesSIX_MINUTES: Round to nearest 6 minutes (1/10 hour)FIFTEEN_MINUTES: Round to nearest 15 minutes (1/4 hour)DRAFT → SUBMITTED → APPROVED → LOCKED → BILLED
↓
REJECTED → DRAFT
The package creates the following tables:
TimeEntry - Individual time recordsTimesheet - Weekly/daily rollupsRateCard - Hourly rates configurationTimeCategory - Categorization of timeTimeLock - Period locking mechanismAuditLog - Complete audit trailAll tables include proper indexes for optimal query performance.
The package includes comprehensive test coverage:
npm test # Run all tests
npm run test:coverage # With coverage report
npm run test:ui # Interactive UI
# Clone the repository
git clone https://github.com/Mrrobotke/iworldafric-timelog.git
cd iworldafric-timelog
# Install dependencies
npm install
# Run tests
npm test
# Build the package
npm run build
Antony Ngigge
MIT © 2024 iWorld Afric
Built with ❤️ by iWorld Afric
FAQs
Advanced Time Log system for iWorldAfric developer platform
We found that @iworldafric/timelog demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.