
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@talkjs/expo
Advanced tools
Official TalkJS SDK for React Native (Expo)
Note: This module is NOT compatible with the Expo GO app since it relies on dependencies that have native modules.
TalkJS is a developer friendly chat API with a pre-built UI that is highly customisable. You can build a chat feature in minutes instead of months.
With TalkJS, you can create chat features that boost user engagement, retention, and conversion rate.

Don't hesitate to let us know if you have any questions about TalkJS.
expo install @talkjs/expo @notifee/react-native @react-native-firebase/app @react-native-firebase/messaging react-native-webview
You can import the library in one of the following ways:
ES6 / TypeScript:
import * as TalkjsRn from '@talkjs/expo';
CommonJS:
const TalkjsRn = require('@talkjs/expo');
Then follow our React Native guide to start using TalkJS in your project.
We promise to never break API compatibility. We may at times deprecate methods or fields, but we will never remove them. If something that used to work stops working, then that's a bug. Please report it and we'll fix it asap.
The package is being released in a beta state. The reason for this is that there are things that one can do with the TalkJS JavaScript SDK that aren't possible with the React Native SDK. We will release v1.0.0 of this package once the two SDKs are similar in terms of features. This however does not take away from our commitment to always maintain backward compatibility. So you can be assured that the package is stable for production use.
Note: These are only the changes that have an effect on the React Native package and its interface. TalkJS gets many improvements and fixes all the time. Consider subscribing to our changelog if you want to stay updated.
ConversationList or Chatbox in order for the user to be created in the backend. This had the
consequence that trying to register the push notification device token with a new user would fail if
you only used the Session component.In v0.13.0, there was an undocumented change where getConversationBuilder() would return the same object if the
conversation ID did not change. This update reverts that change. Now, every call to getConversationBuilder() will
return a new object.
Update dependencies.
onNotificationPressed not working on iOS when using Firebase for push notifications on iOS.hideKeyboardAccessoryView prop to Chatbox and ConversationList. When set to true it
removes the accessory view (^ Ë… and Done) from the top of the iOS keyboard.
The default value is false.setPushRegistration and unsetPushRegistration methods not working.keyboardVerticalOffset prop is now also used in Android. This is part of the fix to ensure proper
keyboard behaviour on apps targeting Android 15 and above.
The default value on Android is 55 + StatusBar.currentHeight.keyboardVerticalOffset to 95.Added customEmojis prop to Chatbox and ConversationList. This prop adds a set of custom emoji images
to the emoji picker, the emoji autocompleter, and emoji reactions. It allows users to send and
receive custom emojis.
Added keyboardVerticalOffset prop to Chatbox. This prop is basically identical to the one passed
to KeyboardAvoidingView.
The default value is 90.
NB: This new prop is only used in iOS. It is used as part of a fix to a bug on iOS where the top part
of the chat would get covered when the keyboard is opened. On Android, the KeyboardAvoidingView
component is disabled.
TypeError: _messageField.getTextResolver is not a function (it is undefined), js engine: hermes. error.scrollToMessage prop to the Chatbox component.expo-notifications or @react-native-firebase/messaging for push notifications
on both Android and iOS.token and tokenFetcher props to Session. These props are part of our efforts at impoving identity verification and authentication.See the reference documentation for full details on the technical requirements for the JSON Web Token(JWT).
signature prop on the Session component.disableZoom prop to Chatbox and ConversationList. This allows you to choose whether the user
can pinch to zoom in and out of the UI. By default its value is false and the usr can zoom into the UI.MessageField methods.getNotificationHandler being undefined.ConversationList no longer highlights the first conversation by default.onMessage and unreadsOnChange props to Session component.hasValidCredentials, clearPushRegistration, setPushRegistation and unsetPushRegistration methods to
Session component.Session when user synchronization is disabled.MessageField.setText and MessageField.typeText that would cause a crash given certain strings.HTMLPanel not loading.onSelectConversation prop is not given. Previously, in this scenario, clicking on a conversation
would result in nothing happening. Now, the conversation will be selected and the TalkJS Inbox Mobile view
will be shown.onSelectConversation in ConversationList.onLeaveConversation, onCustomMessageAction and onCustomConversationAction props. These are intended to replace
the methods with the same names. The methods have hence been deprecated. This change was made to ensure that this SDK's interface
matched the React SDK's.off method in both Chatbox and ConversationList.View will be used in the empty areas around the TalkJS UI.getCurrentConversation, onCustomConversationAction, onLeaveConversation and sendLocation methods to Chatbox.leave method to ConversationBuilder.Chatbox and ConversationList.conversation property in SelectConversationEvent from ConversationBuilderto ConversationData.Cannot assign to property '_injectJavaScript' which has only a getter or
Attempted to assign to readonly property when using React Native version 0.70 and below.Chatbox and ConversationList and it will be shown when
the respective components are loading the UI. This is mostly useful on first load. Subsequent loads of the
UI components are much faster.sendMessage where a message would get sent multiple times in certain scenarios.captureKeyboardEvents prop in Chatbox not working.This is a minor update ensuring a great user experience when using voice messages, particularly on iOS.
To enable voice messages, you'll need to first enable it per role in the TalkJS dashboard. Then you'll need to specify the necessary permissions for both Android and iOS.
For Android, add the following to your AndroidManifest.xml file:
<uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />
<uses-permission android:name="android.permission.RECORD_AUDIO" />
For iOS, add the following to your Info.plist file:
<key>NSMicrophoneUsageDescription</key>
<string>Messages shown to your user when the microphone is accessed for the first time</string>
Fix mark as read. This release ensures that messages are marked as read reliably as long as the chat is visible. If the app is in the background, or the chat is covered by the System UI (example: when receiving a call) then the messages won't be marked as read.
Fix rare crash on Android for SDK 28+ when the @react-navigation/native library is used.
With this release, we have updated the package's dependencies and peer dependencies to keep them up to date and also fix bugs in some of them.
As of npm v7, peer dependencies are installed by default so updating the TalkJS SDK should also update the peer dependencies accordingly. For yarn users, you may have to update the packages individually.
asGuest prop in Chatbox.captureKeyboardEvents and onKeyup props.getText and
typeText to MessageField.oneOnOneId to also accept User Objects.showFeedHeader default to false.feedConversationTitleMode, thirdParties, onBlur and onFocus.chatSubtitleMode, chatTitleMode, thirdParties, translateConversations, onBlur and onFocus.FAQs
Official TalkJS SDK for React Native (Expo)
We found that @talkjs/expo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.