
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@slicemachine/plugin-kit
Advanced tools
Warning
This package is designed for Slice Machine plugin authors. If you are not writing a plugin, you probably don't need to be aware of
@slicemachine/plugin-kit.
A toolkit to build Slice Machine plugins.
npm install @slicemachine/plugin-kit
Coming soon!
Until proper documentation is written, see @slicemachine/adapter-next for an example plugin.
All functions from @slicemachine/plugin-kit are typed and self-documented using TypeScript.
Whether you're helping us fix bugs, improve the docs, or spread the word, we'd love to have you as part of the Prismic developer community!
Asking a question: Open a new topic on our community forum explaining what you want to achieve / your question. Our support team will get back to you shortly.
Reporting a bug: Open an issue explaining your application's setup and the bug you're encountering.
Suggesting an improvement: Open an issue explaining your improvement or feature so we can discuss and learn more.
Submitting code changes: For small fixes, feel free to open a PR with a description of your changes. For large changes, please first open an issue so we can discuss if and how the changes should be implemented.
Copyright 2013-2023 Prismic <contact@prismic.io> (https://prismic.io)
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
FAQs
A set of helpers to develop and run Slice Machine plugins
The npm package @slicemachine/plugin-kit receives a total of 50,291 weekly downloads. As such, @slicemachine/plugin-kit popularity was classified as popular.
We found that @slicemachine/plugin-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.