
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@merkaly/components
Advanced tools
> Attach this to the Vue project. I developed it with reference to Vite's build tool. > This is different from the previous one, and the output is several times different. Amazing, Vue's performance jumps several times!!! Take it, and install it right awa
Attach this to the Vue project. I developed it with reference to Vite's build tool. This is different from the previous one, and the output is several times different. Amazing, Vue's performance jumps several times!!! Take it, and install it right away and try it out.
-- Tem Ray
This template is for using Vue2 with TypeScript in Vite. Includes vue-router and Vuex, vue-property-decorator.
In addition, ESLint, Stylelint, and Prettier are also included and are set to be executed automatically at runtime and commit. (Since these settings are set strictly, please relax yourself.)
| Command | Description |
|---|---|
| dev | Start devserver. |
| clean | Clear devserver cache. |
| build | Build for production |
| build:clean | Clear production build files. |
| lint | Run ESLint and prettier. |
| lint:style | Run Stylelint. |
| lint:markup | Check vue markup. |
| preview | Run the program generated by the production build. |
It also works when migrating from VueCLI.
However, when importing a stylesheet with @import, it cannot be specified from the library directory. Must be specified from ~node_modules/.
Also, if you used the .env file in the previous environment, you need to change the calling part from process.env to import.meta.env after installing vite-plugin-env-compatible separately.
When adding or deleting files, an error may occur and even if the error is corrected, it may not be reflected in devserver. In that case, stop devserver and delete all the files in the node_modules/.vite directory. You can also run it with the clean command.
FAQs
> Attach this to the Vue project. I developed it with reference to Vite's build tool. > This is different from the previous one, and the output is several times different. Amazing, Vue's performance jumps several times!!! Take it, and install it right awa
We found that @merkaly/components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.