
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@nectary/components
Advanced tools
Design System's framework-agnostic Component Library implementation.
Nectaries are specialized nectar-producing structures of the flower.
Bumblebees eat nectar and pollen made by flowers. The sugary nectar provides the bees with energy while the pollen provides them with protein.
Add the component library dependency to package.json:
npm install @nectary/components
# or
yarn add @nectary/components
Nectary needs a custom elements registry to work with, even if it's a global default one:
import { setNectaryRegistry } from '@nectary/components/utils'
setNectaryRegistry(window.customElements)
// App
Or a custom one for the Shell/MFE use case, see mfe-helper-react as an example for more details:
import { setNectaryRegistry } from '@nectary/components/utils'
const customRegistry = new CustomElementRegistry();
setNectaryRegistry(customRegistry)
// ShadowRoot wrapper
import '@nectary/theme-base'
Use color palette or custom font face:
span {
color: var(--sinch-color-honey-700);
}
h2 {
font: var(--sinch-font-title-l);
}
Import component:
import '@nectary/components/button'
Use it in React/Vue/Angular/etc, for example:
<sinch-button value="Click me" onClick={() => console.log('click')}></sinch-button>
⚠️ Note: it's not allowed to self-close custom element tags.
If you are testing your application using Nectary components with Jest, you might run into some problems, as it does not work out of the box. Here are the common pitfalls and their solutions.
jest.config.js
/** @type {import("ts-jest/dist/types").InitialOptionsTsJest} */
module.exports = {
preset: "ts-jest",
testEnvironment: "jsdom",
moduleNameMapper: {
"\\.(css)$": "identity-obj-proxy"
},
transform: {
"^.+\\.(ts|tsx)?$": "ts-jest",
"^.+\\.(js|jsx)$": "babel-jest"
},
transformIgnorePatterns: [
"node_modules/(?!@nectary)"
]
}
babel.config.js
module.exports = {presets: ['@babel/preset-env']}
If you already have a babel loader for CSS, you might not need this part. If you do not, you can use identity-obj-proxy to mock your CSS imports:
npm install identity-obj-proxy
# or
yarn add identity-obj-proxy
Then add this part to your jest.config.js file:
moduleNameMapper: {
"\\.(css)$": "identity-obj-proxy"
},
It lets Jest know how to mock the css imports in your codebase, like for example when you import the theme:
import '@nectary/theme-base'
This import should not throw an error now.
You are going to need to install babel-jest if it is not already done:
npm install babel-jest
# or
yarn add babel-jest
Then add this lines to your jest.config.js file:
transform: {
"^.+\\.(ts|tsx)?$": "ts-jest", // if you are using Typescript and ts-jest
"^.+\\.(js|jsx)$": "babel-jest"
},
transformIgnorePatterns: [
"node_modules/(?!@nectary)"
]
It is necessary to export the env preset in the babel.js.config file:
module.exports = {presets: ['@babel/preset-env']}
If you import any component:
import '@nectary/components/input'
It should not throw the error:
Jest encountered an unexpected token
FAQs
Design System's framework-agnostic Component Library implementation.
The npm package @nectary/components receives a total of 4,560 weekly downloads. As such, @nectary/components popularity was classified as popular.
We found that @nectary/components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.