Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@jimdo/components-stats
Advanced tools
Collect stats about ui components usage across the specified GitHub org
Collect usage statistics for any npm package exposing React UI components, across a GitHub organization. Inspired by Twilio.com blogpost.
The aim is to provide better understanding of Design System or other shared UI libraries usage across the organization. This tool will facilitate things such as: deprecation of unused components and props, detection of misuse, set-up of alerts.
Create a config.json file based on config.example
.
A GitHub personal access token with scope repo
is required, to access the org
private repositories through GitHub APIs.
Usage for pkgName
will be analyzed across org
, excluding repositories that did not receive any commit in the last daysUntilStale
days.
Be patient, this will take some time.
The list of repositories having pkgName
as dependency is collected through the package-adoption npm module.
Omit components
to report all components.
:warning: The script will clone all the eligible repositories locally and use them as source for react-scanner. If a repository already exists locally, it will update it with a
git pull
.
# Install dependencies using npm
$ > npm i
# Start
$ > npm start
The script outputs:
a pkgAdoption.json
file with the list of repositories that include pkgName
as a dependency.
two reports_by_repo
folders with one scanner-report_[repo_name_subdir].json
file for each repository. Each file is a report with the usage of React components exposed by the pkgName
library.
react-scanner is used to produce two kind of reports: one with the count-components-and-props processor and one with the raw-report processor, reporting all the props values.
npm install @jimdo/components-stats
import { scanOrg } from '@jimdo/components-stats';
const config = {
org: 'github_org_name',
pkgName: '@org/package',
ghAuthToken: 'github_auth_token',
daysUntilStale: '730',
components: { Accordion: true, Button: true },
};
await scanOrg(config);
FAQs
Collect stats about ui components usage across the specified GitHub org
The npm package @jimdo/components-stats receives a total of 12 weekly downloads. As such, @jimdo/components-stats popularity was classified as not popular.
We found that @jimdo/components-stats demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.