
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@milkfloat/components
Advanced tools
This is currently under development.
You can view and interact with this library using our UI Workshop powered by Storybook.
To contribute, see our guidance documentation at halo-ui-guidance for some guidance on coding best practice and standards.
Certain components within the Halo library make use of Moasic (Lowside Stub) components from GLib. To make use of these lowside components you will need to update your .npmrc file with the registry location and authToken to allow npm to find the libaries.
npm login --registry=<Glib Registry> --scope=@glib
In the project directory, you can run:
npm run storybookRuns the UI Workshop for the Library.
Open http://localhost:9009 to view it in the browser.
The page will reload if you make edits.
npm testLaunches the test runner in the interactive watch mode.
See the section about running tests for more information.
npm run buildPrettifies the codebase to meet coding standards then creates a dist version of the library which will be used by peer projects. Note that you will need to run this for peers to be able to use the updated codebase.
We use kcd-scripts to provide our utility scripts and tools for development. These include babelifying our codebase ready for distribution and linting utility. These are easily extended via the standard configuration files for babel and prettier. See: https://github.com/kentcdodds/kcd-scripts
For developers looking to contribute to this project, please consider helping out on the following:
FAQs
This is currently under development.
We found that @milkfloat/components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.