
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@likecoin/edm
Advanced tools
Email templates for LikeCoin.
This repository is scaffolded by TSDX.
To run, use:
npm start # or yarn start
This builds to /dist and runs the project in watch mode so any edits you save inside src causes a rebuild to /dist.
To do a one-off build, use npm run build or yarn build.
To run tests, use npm test or yarn test.
Code quality is set up with prettier, husky, and lint-staged.
Jest tests are set up to run with npm test or yarn test.
size-limit is set up to calculate the real cost of the library with npm run size and visualize the bundle with npm run analyze.
TSDX uses Rollup as a bundler and generates multiple rollup configs for various module formats and build settings. See Optimizations for details.
tsconfig.json is set up to interpret dom and esnext types, as well as react for jsx. Adjust according to your needs.
Two actions are added by default:
main which installs deps w/ cache, lints, tests, and builds on all pushes against a Nodesize which comments cost comparison of your library on every pull request using size-limitPlease see the main tsdx optimizations docs. In particular, know that you can take advantage of development-only optimizations:
// ./types/index.d.ts
declare var __DEV__: boolean;
// inside your code...
if (__DEV__) {
console.log('foo');
}
You can also choose to install and use invariant and warning functions.
CJS, ESModules, and UMD module formats are supported.
The appropriate paths are configured in package.json and dist/index.js accordingly. Please report if any issues are found.
Per Palmer Group guidelines, always use named exports. Code split inside your React app instead of your React library.
There are many ways to ship styles, including with CSS-in-JS. TSDX has no opinion on this, configure how you like.
For vanilla CSS, you can include it at the root directory and add it to the files section in your package.json, so that it can be imported separately by your users and run through their bundler's loader.
We are using np.
Run np and follow the steps:
make sure you have installed
npglobally
np
FAQs
Email templates for LikeCoin.
We found that @likecoin/edm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.