
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@rrnara/opentok-react-native
Advanced tools
React Native library for OpenTok iOS and Android SDKs
In your terminal, change into your React Native project's directory
Add the library using npm or yarn.
npm install opentok-react-nativeyarn add opentok-react-nativeNote: Please make sure to have CocoaPods on your computer.
If you've installed this package before, you may need to edit your Podfile and project structure because the installation process has changed.
In you terminal, change into the ios directory of your React Native project.
Create a pod file by running: pod init.
For React Native < 0.60, add this to your Podfile:
target '<YourProjectName>' do
# Pods for <YourProject>
pod 'OpenTok', '2.20.0'
end
Now run, pod install
After installing the OpenTok iOS SDK, change into your root directory of your project.
For React Native < 0.60, now run react-native link opentok-react-native.
Open <YourProjectName>.xcworkspace contents in XCode. This file can be found in the ios folder of your React Native project.
Click File and New File
Add an empty swift file to your project:
OTInstall.swift. This is done to set some flags in XCode so the Swift code can be used.Click Create Bridging Header when you're prompted with the following modal: Would you like to configure an Objective-C bridging header?
Ensure you have enabled both camera and microphone usage by adding the following entries to your Info.plist file:
<key>NSCameraUsageDescription</key>
<string>Your message to user when the camera is accessed for the first time</string>
<key>NSMicrophoneUsageDescription</key>
<string>Your message to user when the microphone is accessed for the first time</string>
If you try to archive the app and it fails, please do the following:
In your terminal, change into your project directory.
If you have already run react-native link opentok-react-native for the iOS installation, please skip this step.
react-native link opentok-react-nativeOpen your Android project in Android Studio.
Add the following to your project build.gradle file:
maven {
url "http://tokbox.bintray.com/maven"
}
AndroidManifest.xml file (needed for Screen Sharing to work): <service
android:name="com.opentokreactnative.OTForegroundService"
android:foregroundServiceType="mediaProjection"
android:enabled="true"
android:exported="false" />
Sync Gradle
Make sure the following in your app's gradle compileSdkVersion, buildToolsVersion, minSdkVersion, and targetSdkVersion are greater than or equal to versions specified in the OpenTok React Native library.
As for the older Android devices, ensure you add camera and audio permissions to your AndroidManifest.xml file:
<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
<uses-permission android:name="android.permission.RECORD_AUDIO" />
<uses-feature android:name="android.hardware.camera" android:required="true" />
<uses-feature android:name="android.hardware.camera.autofocus" android:required="false" />
<uses-feature android:name="android.hardware.microphone" android:required="true" />
Newer versions of Android–API Level 23 (Android 6.0)–have a different permissions model that is already handled by this library.
Bintray support has ended (official announcement: https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/). In your app build.gradle file you need to remove reference to jcenter and replace it with mavenCentral. Example:
// Top-level build file where you can add configuration options common to all sub-projects/modules.
buildscript {
...
repositories {
google()
mavenCentral()
}
...
}
allprojects {
repositories {
maven {
// All of React Native (JS, Obj-C sources, Android binaries) is installed from npm
url("$rootDir/../node_modules/react-native/android")
}
maven {
// Android JSC is installed from npm
url("$rootDir/../node_modules/jsc-android/dist")
}
mavenCentral {
// We don't want to fetch react-native from Maven Central as there are
// older versions over there.
content {
excludeGroup "com.facebook.react"
}
}
google()
maven { url 'https://www.jitpack.io' }
}
}
To see this library in action, check out the opentok-react-native-samples repo.
Interested in contributing? We :heart: pull requests! See the Contribution guidelines.
We love to hear from you so if you have questions, comments or find a bug in the project, let us know! You can either:
FAQs
React Native components for OpenTok iOS and Android SDKs
We found that @rrnara/opentok-react-native demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.