
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@versesdev/hsml-viewer
Advanced tools
This is published at NPM here: https://www.npmjs.com/package/@versesdev/hsml-viewer
This is published at NPM here: https://www.npmjs.com/package/@versesdev/hsml-viewer
A minimal example implementation can be found at src/App.tsx. To run this minimal example locally, do the following:
npm i
npm run dev
For a more thorough example implementation look at Workbench: https://github.com/VersesTech/workbench
step1:
To start, in this package run npm run buildwatch, this will call vite build --watch which will cause the package to build whenever a change is made to any of the compiled code.
step2:
run npm link inside this package
run npm link @versesdev/hsml-viewer inside the consumer app
Now when you make changes in this app you will get an auto rebuild, right now it takes about 7 seconds which isn't great, but better than having to manually rebuild after every change.
I like to run this when i'm ready to unlink as it gives a nice clean break: npm unlink && rm -rf node_modules && npm install
It's helpful to install this vs code extension, https://marketplace.visualstudio.com/items?itemName=roblourens.npm-link-status which will show an icon at the bottom of your vscode when you are linked in your consumer app.
you can also just run npm list in the consumer app and it will show you if this package is linked or not
src/example/resAWS_UPLOAD_ENABLED enabled in .envFAQs
This is published at NPM here: https://www.npmjs.com/package/@versesdev/hsml-viewer
We found that @versesdev/hsml-viewer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 38 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.