
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@virtahealth/substrate-styles
Advanced tools
Universal styling properties for use in Virta products.
All Substrate primitives and styles are encoded in YAML, transformed into multiple formats and syntaxes with Theo, and exported for consumption by any Virta app or website.
Substrate styles are currently exported in these formats:
Additional transforms can be added/created as needed.
Styles are thematic properties that are applied to UI elements. They're composed of primitives which can be swapped to create custom themes.
Visual primitives are constants that are combined to create styles.
Substrate exports a set of base styles that constitute a base theme. Custom themes can be created from the base theme by using overrides, either locally in a project's style assignments or, in special cases, a theme exported from Substrate.
FAQs
Substrate Styles
The npm package @virtahealth/substrate-styles receives a total of 0 weekly downloads. As such, @virtahealth/substrate-styles popularity was classified as not popular.
We found that @virtahealth/substrate-styles demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.