
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@unbabel/samora-vue3-components
Advanced tools
This is the Unbabel Design System Vue3 component library.
⚠️ Requires node >= 20 ⚠️
1) Install it using npm
npm i --save @unbabel/samora-vue3-components
2) Add Erik Meyer's CSS reset to your App, which can be found here, so that all CSS styles are rendered properly.
There are currently 4 (tested) ways of using Samora:
Install Samora via NPM, saving it as a dependency
npm i --save @unbabel/samora-vue3-components
Import the components into your app using:
<script setup>
import { SamButton } from '@unbabel/samora-vue3-components';
</script>
And set it as a component on VueJS:
<template>
<SamButton label="CLICK ME" />
</template>
Import Samora as a script from one of the CDN providers with the appropriate version you want to include on your project
// UMD
<script src="https://unpkg.com/@unbabel/samora-vue3-components@0.1.0/vue3-components.umd.js"></script>
// or ES
<script src="https://unpkg.com/@unbabel/samora-vue3-components@0.1.0/vue3-components.es.js"></script>
If you are using import maps, you can also add this library to it:
{
"@unbabel/samora-vue3-components": "https://unpkg.com/@unbabel/samora-vue3-components@0.1.0/vue3-components.umd.js"
}
The library preview can be found here along with the documentation on how to use the components
Be sure to follow Samora Operational Guidelines on the Frontend Tribe's wiki
git pull origin maingit checkout -b UFE-1234/brief-descriptionnpm version <major|minor|patch>⚠️ Commits messages to follow the following format:
"[vue3-components] custom message"
To develop or add new components, install the project dependencies and launch Storybook server to preview your components:
npm i
npm run storybook
Don't forget to "register" your new component on the src/components/index.ts file.
If this is not done, even if the component has been coded, it won't be available to be used.
src/components/<ComponentType>/<NewComponentNamesrc/components/index.ts import and export <NewComponentName>npm run test or npm run test:ui to get a prettier visualisation.
vitest --run --testNamePattern=<describeName>.<testCaseName> <ComponentName>.spec.ts
Ensure that your IDE terminal is configured to run on node >= 20
This Samora module creates two builds
npm run storybook:buildcd storybook-static && hostr --port 11000npm run buildcp package.json dist && cd dist && npm packnpm i <absolutePathToDistFolder>/unbabel-samora-vue3-components-<version>.tgzgit pull origin maingit tag vue3-components/vX.Y.Zgit push origin tag vue3-components/vX.Y.ZFAQs
Samora - the Unbabel design system - Vue3 components
The npm package @unbabel/samora-vue3-components receives a total of 3,936 weekly downloads. As such, @unbabel/samora-vue3-components popularity was classified as popular.
We found that @unbabel/samora-vue3-components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.