
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@uniformdev/context-ui
Advanced tools
.env.example and rename to .env, set up your project id, host, and API key.pnpm storybook - run storybook app on http://localhost:9011/, is used for creating and editing components.Icon component can be is used only as a child of IconsProvider component.
pnpm build - builds icons, JS modules, and CSS.This package uses Tailwind CSS. Run pnpm build:css to compile the CSS file, which will run PostCSS with the Tailwind plugin against all .css files in the assets folder. The compiled CSS will be output to dist/assets/[filename].css.
When Sanity Studio imports the JS modules exported by our plugin, the Sanity Studio bundler will also automatically import any CSS files that our code imports, e.g. import '../dist/assets/optimize.css';
NOTE: be sure to set NODE_ENV=production if you want PostCSS to purge unused CSS.
If you want to import SVG icons as components in your code, do the following:
src/assets folderpnpm build:iconsThis will generate React components for every SVG icon in the src/assets folder. You can then import the icons in other React components, e.g. import MyIcon from '../assets/MyIcon';.
Ideally, we could have import MyIcon from '../assets/my-icon.svg in our code and the SVG icon would automatically be converted to a React component at build time and our source code would be transformed to import the component. However, we're not using a bundler so it becomes challenging because we can't "hook" into the TypeScript build/transpile process. We could introduce a build tool like ESBuild or @babel/typescript and stop using tsc, but those options more tooling/overhead. We could also potentially use something like ttypescript (https://github.com/cevek/ttypescript) to create babel-esque plugins for TypeScript, but who knows how reliable that is and if we'd run into any issues in CI/testing.
So, for now, icons are somewhat of a manual process.
No CommonJS modules are exported from this package as the package is intended to be consumed by Sanity Studio and not used during SSR.
FAQs
React-based functionality and components for Uniform Context
The npm package @uniformdev/context-ui receives a total of 149 weekly downloads. As such, @uniformdev/context-ui popularity was classified as not popular.
We found that @uniformdev/context-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.