
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@uktrade/datahub-header
Advanced tools
An npm module for the Data Hub header component. This provides a nunjucks macro that will take the permitted_applications from SSO and render the header. There are some additional options for more functionality.
This is published under the @uktrade scope in NPM. To install: npm install --save @uktrade/datahub-header
If you add node_modules/@uktrade to the configure option of nunjucks:
nunjucks.configure( [
`${__dirname}/views`,
`node_modules/@uktrade`,
] );
You can import into your template with {% from 'datahub-header/component/header.njk' import datahubHeader %} and call the macro to render the header:
{{ datahubHeader( user.permitted_applications ) }}
There are several options to control the items in the header.
key to mark as the active nav item in the top level navigation<header> element - GOVUK frontend style<ul> elementAfter installation you need to add the CSS and JS to your app. If using SASS you should be able to @import 'node_modules/@uktrade/datahub-header/component/header';
Similarly, the path to the JS file for inclusion in your bundler should be node_modules/@uktrade/datahub-header/component/header.js
To test the various headers in a browser there is a local Node.js server with multiple pages, first install the dependencies: npm install, generate the CSS files with npm run sass:dev, then run npm start to start it. You can control the port number by setting a PORT env variable.
If you want to add more test scenarios then it will be easier to have the files watched for changes and restart automatically. Simply run npm run watch to start the server in watch mode.
The server is a basic http.createServer without any framework, so simply add a new template and update the switch statement with the new url path to match on. You will probably want to update the createSubnav function that is passed to the templates to add the new item, so you have a link to it.
The deployment documentation is available here
FAQs
The Data Hub header component
We found that @uktrade/datahub-header demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.