
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@sucoza/devtools-importer
Advanced tools
Simplified Vite plugin for importing and configuring TanStack DevTools plugins
A simplified Vite plugin for importing and configuring TanStack DevTools plugins with automatic port management and configuration.
npm install @sucoza/devtools-importer
// vite.config.js
import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
import { tanstackDevtoolsImporter } from '@sucoza/devtools-importer';
export default defineConfig({
plugins: [
// ⚠️ IMPORTANT: tanstackDevtoolsImporter MUST be first!
tanstackDevtoolsImporter({
plugins: [
'@sucoza/api-mock-interceptor-devtools-plugin',
'@sucoza/websocket-signalr-devtools-plugin',
'@sucoza/memory-performance-profiler-devtools-plugin'
],
config: {
defaultOpen: false,
position: 'bottom-right', // TanStack DevTools position
hideUntilHover: true,
panelLocation: 'bottom'
},
port: { min: 40000, max: 49999 }, // or specify a fixed port: 3001
})
],
});
// App.tsx
import React from 'react';
import { DevToolsManager } from '@sucoza/devtools-importer/react';
function App() {
return (
<div>
<h1>My Application</h1>
{/* DevTools configured in vite.config.js, will only render in development */}
<DevToolsManager />
</div>
);
}
export default App;
// Custom DevTools setup with error handling
import React from 'react';
import { DevToolsManager } from '@sucoza/devtools-importer/react';
function App() {
return (
<div>
<DevToolsManager
onError={(error) => console.error('DevTools Error:', error)}
onPluginLoad={(pluginId) => console.log('Loaded plugin:', pluginId)}
className="my-devtools"
/>
</div>
);
}
interface TanstackDevtoolsImporterOptions {
// Required: List of plugin import paths
plugins: string[];
// Optional: DevTools core configuration
config?: Partial<TanStackDevtoolsConfig>;
// Optional: Event bus configuration
eventBusConfig?: Partial<ServerEventBusConfig>;
// Optional: Enhanced logging toggle
enhancedLogs?: { enabled: boolean };
// Optional: Port configuration
port?: number | { min: number; max: number };
// Optional: Enable in production (default: false)
enableInProd?: boolean;
// Optional: Virtual module ID prefix (default: "virtual:tdi")
virtualIdBase?: string;
}
interface DevToolsManagerProps {
// Optional: Custom className
className?: string;
// Optional: Error handler
onError?: (error: Error) => void;
// Optional: Plugin load handler
onPluginLoad?: (pluginId: string) => void;
}
The DevToolsManager uses the TanStack DevTools configuration passed through the Vite plugin, including position, styling, and behavior options.
The plugin creates virtual modules that you can import:
// Access plugin loaders
import { pluginLoaders, pluginIds } from 'virtual:tdi/plugins';
// Access resolved configuration
import { devtoolsConfig } from 'virtual:tdi/config';
// vite.config.js
export default defineConfig({
plugins: [
tanstackDevtoolsImporter({
plugins: ['@sucoza/api-mock-interceptor-devtools-plugin']
})
]
});
// vite.config.js
export default defineConfig({
plugins: [
tanstackDevtoolsImporter({
plugins: [
'@sucoza/api-mock-interceptor-devtools-plugin',
'@sucoza/websocket-signalr-devtools-plugin',
'@sucoza/render-waste-detector-devtools-plugin'
],
port: 3001,
config: {
defaultOpen: true,
}
})
]
});
// vite.config.js
export default defineConfig({
plugins: [
tanstackDevtoolsImporter({
plugins: ['@sucoza/api-mock-interceptor-devtools-plugin'],
enableInProd: true, // Enable in production builds
})
]
});
# Install dependencies
npm install
# Build the package
npm run build
# Watch mode for development
npm run dev
# Type checking
npm run typecheck
# Linting
npm run lint
MIT
FAQs
Simplified Vite plugin for importing and configuring TanStack DevTools plugins
We found that @sucoza/devtools-importer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.