
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mkhuda/react-shaka-player
Advanced tools
React video player built on top of Shaka Player.
Use the package manager yarn or npm to install @mkhuda/react-shaka-player.
yarn add @mkhuda/react-shaka-player shaka-player
or
npm install @mkhuda/react-shaka-player shaka-player
// import the css. Now we have custom ui.css
import "@mkhuda/react-shaka-player/dist/ui.css";
import { ReactShakaPlayer } from "@mkhuda/react-shaka-player";
function App() {
return <ReactShakaPlayer autoPlay={true} src={"https://yourvideohere.mpd"} />;
}
import "@mkhuda/react-shaka-player/dist/ui.css";
import { ReactShakaPlayer } from "@mkhuda/react-shaka-player";
function App() {
let [mainPlayer, setMainPlayer] = useState({});
useEffect(() => {
const { player, videoElement } = mainPlayer;
if (player) {
async function play() {
await player.load("https://yourvideomaster.mpd");
videoElement.play();
}
play();
}
}, [mainPlayer]);
return (
<div className="App">
<div className="App-main">
<ReactShakaPlayer
playerClassName="player-class-name"
onLoad={(player) => setMainPlayer(player)}
/>
</div>
</div>
);
}
This is main props for the components:
| Props | Optional | Description | Type |
|---|---|---|---|
| src | No | MPD or HLS to play | string |
| className | Yes | string of ui overlay classname | string |
| autoPlay | Yes | as it described | boolean |
| superConfig | Yes | The special configs for Streaming or VOD. Will add more superConfig soon. | string ("STREAMING" / "VOD") |
| config | Yes | Changes configuration settings on Shaka Player. Reference: shaka.extern.PlayerConfiguration. This config will override superConfig. | object |
| uiConfig | Yes | Changes configuration settings for UI elements. Reference: shaka.extern.UIConfiguration. This config will override superConfig. | object |
| onLoad | Yes | Catch Shaka.Player, Shaka.ui.Overlay and HTMLVideoElement for manual usages or improvement of configuration. see: PlayerRefs | object: PlayerRefs => func |
| onPlay | Yes | Catch when media is playing | func |
| onPlause | Yes | Catch when media is paused | func |
| onEnded | Yes | Catch when video is end | func |
| onBuffering | Yes | Catch onBuffering status when playing | bool => func |
| onPlayerError | Yes | Catch error when playing. Reference: Shaka.Player.ErrorEvent | {Shaka.extern.Error} => func |
| onStatsChanged | Yes | Catch stats when playing video, including currentTime (current seek position), and currentEndTime (length of video duration if VOD) (in seconds) of media player element [IStats]. Reference: IStats & Shaka.extern.Stats | {Shaka.extern.Stats} => func |
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
Please make sure to update tests as appropriate.
FAQs
React video player built with Shaka-Player
We found that @mkhuda/react-shaka-player demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.