
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@muchbetteradventures/notification-preferences
Advanced tools
<!DOCTYPE html>
<html lang="en">
<head>
<!-- Include script from the NPM CDN. -->
<script type="text/javascript" src="https://unpkg.com/@muchbetteradventures/notification-preferences@0.1.0/standalone/index.js"></script>
</head>
<body>
<!-- Create a placeholder for the react app. -->
<div
<!-- Add classname for the initializer script to find it -->
class="mba-notification-preferences-container"
<!-- Add data attributes to configure the app-->
data-knock_public_key="pk_test_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
data-auth_url="/authentication-url/"
></div>
</body>
</html>
classNameMust contain mba-notification-preferences-container - this is needed for discovery of the placeholder.
data-knock_public_keyKnock public key. See the official Knock documentation on how to get it.
data-auth_urlThe url from where the knock client can obtain a signed authentication token. The client will send simple GET request and expects a JSON response in the following format:
{
"userToken": "JWT signed by a valid knock secret key",
"userId": "Knock id used to identify the current user"
}
For more info on Knock secret key, see the official Knock documentation.
More info on JWT signing and format
In the project directory, you can run:
yarn startRuns the app in the development mode.
Open http://localhost:3000 to view it in the browser.
The page will reload if you make edits.
You will also see any lint errors in the console.
yarn testLaunches the test runner in the interactive watch mode.
See the section about running tests for more information.
yarn buildBuilds the app for production to the build folder.
It correctly bundles React in production mode and optimizes the build for the best performance.
The build is minified and the filenames include the hashes.
Your app is ready to be deployed!
See the section about deployment for more information.
yarn ejectNote: this is a one-way operation. Once you eject, you can’t go back!
If you aren’t satisfied with the build tool and configuration choices, you can eject at any time. This command will remove the single build dependency from your project.
Instead, it will copy all the configuration files and the transitive dependencies (webpack, Babel, ESLint, etc) right into your project so you have full control over them. All of the commands except eject will still work, but they will point to the copied scripts so you can tweak them. At this point you’re on your own.
You don’t have to ever use eject. The curated feature set is suitable for small and middle deployments, and you shouldn’t feel obligated to use this feature. However we understand that this tool wouldn’t be useful if you couldn’t customize it when you are ready for it.
yarn publishPushes the content of the build directory (standalone) to npm.
yarn releaseShorthand for build, publish and gen-sri.
yarn gen-sriGenerates sha384 hash to be used for SRI.
You can learn more in the Create React App documentation.
To learn React, check out the React documentation.
FAQs
## Example usage
We found that @muchbetteradventures/notification-preferences demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.