
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Action->Dispatch->Services->Store flow
npm install --save adss
import { createLogic } from 'adss'
const logic = createLogic()
You can set initial state, your own services and servicesFactories:
import { createLogic, services, servicesFactories } from 'adss'
const initialState = {}
const myServices = {
...services,
log: (text) => console.log(text)
}
const myServicesFactories = {
...servicesFactories,
logState: (services, dispatchContext) => {
dispatchContext.myCounter = 1
return () => console.log(dispatchContext.myCounter, dispatchContext.getState())
}
}
const logic = createLogic(initialState, myServices, myServicesFactories)
logic.getState()
const action = actions.action1(value1, value2)
logic.dispatch(action)
Action is a function that call available services
const actionX = (services) => {
const { getState, setState, dispatch, serviceX, ...otherServices } = services
const state = getState()
setState((state) => ({...state, v1: arg1}) )
dispatch(actionY) //dispatch another action
serviceX() //call your own service
}
For create actions use HOF:
const initValue = () => ({ setState }) => {
setState((state) => ({...state, v1: 0}) )
}
const incrementValue = (v) => ({ setState }) => {
setState((state) => ({...state, v1: state.v1 + v}) )
}
const multiplyValue = (v) => ({ setState }) => {
setState((state) => ({...state, v1: state.v1 * v}) )
}
const incMultValue = (inc, mult) => ({ dispatch }) => {
dispatch(incrementValue(inc))
dispatch(multiplyValue(mult))
}
const incMultValueOnce = (inc, mult) => ({ hold }) => {
hold(({ dispatch }) => {
dispatch(incrementValue(inc))
dispatch(multiplyValue(mult))
})
}
You can use callback if you want to change something each time when store changed
const onStateChangeCallback = (state) => conslole.log(state)
logic.subscribe(onStateChangeCallback)
Callback will help if we need rerender something in view each time when state change
const onStateChangeCallback = (state) => conslole.log(state)
logic.subscribe(onStateChangeCallback)
// dispatch any actions
logic.unsubscribe(onStateChangeCallback)
It is proposed to use one file to aggregate logic of one area of the business logic. This file contains:
export const updater = (reducer) => (store) => ({...store, moduleX: reducer(store.moduleX)})
This is HOF that describe how to update main store. It get global state and return new one with changed only one part. You can use immutable js or other libraries for implement this
export const selector = (store) => store.moduleX
export const selectPartXSum = (store) => store.moduleX.v1 + store.moduleX.v2
This function describe how to select part from the main store. You can use reselect or other libraries for implement this
const stateAction = (reducer) => ({setState}) => setState(updater(reducer))
const incrementValue = (v) => stateAction((state) => ({...state, v1: state.v1 + v}) )
const multiplyValue = (v) => stateAction((state) => ({...state, v1: state.v1 * v}) )
const incMultValue = (inc, mult) => ({ dispatch }) => {
dispatch(incrementValue(inc))
dispatch(multiplyValue(mult))
}
const incMultValueOnce = (inc, mult) => ({ hold }) => {
hold(({ dispatch }) => {
dispatch(incrementValue(inc))
dispatch(multiplyValue(mult))
})
}
These is action creators that return actions. Action use defined services for change state
const init = () => stateAction((state) => ({...state, v1: 0}) )
This is init action creator. You should dispatch it when init application
import { createLogic } from 'adss'
import { moduleX } from './moduleX'
const logic = createLogic()
logic.dispatch(moduleX.init())
const render = (state) => {
//rerender view
}
logic.subscribe(renderer)
logic.dispatch(actions.initValue())
// render call once
logic.dispatch(actions.incMultValue(2,5))
// render call twice
// because setState service will call twice
logic.dispatch(actions.incMultValueOnce(2,5))
// render call once
// because 'setState' service held by 'hold' service
Use npm module react-adss
todo
MIT
FAQs
Action->Dispatch->Services->Store flow
The npm package adss receives a total of 0 weekly downloads. As such, adss popularity was classified as not popular.
We found that adss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.