
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@tarojsx/library
Advanced tools
当前代码提交频繁, 一些特性时有变化.
待续不断搜索可以运行在 Taro3 环境下的优秀第三方类库.
:gift: 使用原始 npm 包, 保持原汁原味, 不做侵入性的修改.
:wrench: 简化配置, 搭配 @tarojsx/polyfill 使用.
:mag_right: 完善的 Typescript 类型提示.
:telescope: 持续探索中...
npm i @tarojsx/library @tarojsx/polyfill
部分组件需要用到 polyfill.
更新 config/index.js 配置如下
const { TaroProvidePlugin } = require('@tarojsx/polyfill/dist/plugins')
const config = {
mini: {
webpackChain(chain, webpack) {
chain
.plugin('taroProviderPlugin')
.use(TaroProvidePlugin)
}
}
}
FixedSizeListVariableSizeListFixedSizeTree欢迎各种形式的支持. 至少可以给颗星 :star:
npm run testFailed to launch wechat web devTools,请先退出微信开发者工具。FAQs
Taro3 library
We found that @tarojsx/library demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.