
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
bidder-react
Advanced tools
the new and improved bidder-react and stuff getting better and better
This repo takes advantage of a webpack alias, where you may see many imports that simply start with @
These @
imports are just aliased to be the root /src/
folder of the build. If you see @/redux
, the true path is bidder-react/src/redux
Example:
// Before
import { BidIncrement } from '../../../types/BidIncrement';
// After
import { BidIncrement } from '@/types/BidIncrement';
Try to use this alias whenever reasonable, a good rule of thumb is if you will use a ../
use the @
alias
Log in to NPM (Your npm account is in the liveauctioneers npm org, right?)
npm login
Install NPM dependencies
npm install
For initial development, run the build on stage
environment:
npm run dev
or npm run stage
For pre-release testing on live data, run the build on preprod
environment:
npm run preprod
- you have been further cautioned: this is a live data environment
For custom environment testing, export DEPLOYMENT variable:
(Windows) $Env:DEPLOYMENT="barako"
(Not Windows) export DEPLOYMENT=barako
run npm run local
which will use DEPLOYMENT from environment
Because of the way we build webpack, sometimes when you start the dev server, it will serve the previous build until the new build is completed.
You might see errors about packages that have recently been removed, not being found (since they were removed).
The easiest way to fix this is to clean the build folders with npm run clean
.
If things are acting weird, it is always safe to remove the node_modules folder and the package-lock.json file and reinstall the dependencies.
rm -rf node_modules
rm -rf package-lock-json
npm i
If you update your Node major version, the local node-sass library will need to be updated before npm run dev
will work. To fix this, run npm rebuild node-sass
On all non production builds (not on master), react profiling is available. https://reactjs.org/blog/2018/09/10/introducing-the-react-profiler.html
Open up developer tools with the latest version of react dev tools extension, and go to the "Profiler" tab. Hit "Start Profiling" at the top left,
do any action, and then press the same button to stop recording.
You can also press the reload symbol next to the start profiling button to refresh the page and immediately start profiling (only available on
chrome version of react dev tools)
If you press the gear icon near the top right of the developer tools when in the "Profiler" tab, and then switch to the "Profiler" tab inside the new options window, you can hide commits (page updates) below a certain threshhold, 2ms being a good starting setting on a fast computer.
If profiling suddenly becomes unavailable, close and reopen dev tools to make the issue go away (you may also need to refresh).
While profiling works very well with non-minified test builds on local development environments, the minified versions on built webpages can pose problems.
To identify a component on the profiler tab when minified, follow these steps:
Select the component so options above it are greyed out
Switch tabs in developer tools to Components
Mouse over and highlight the component, which in turn highlights it on the webpage.
We do SSR
The entire site needs to be addressable from any subdomain of liveauctioneers.com (*.liveauctioneers.com). The index (Home) page of each domain will change depending on which domain is used to access the site.
To test on local, point the auction house you want to test with to localhost in your hosts file (/etc/hosts
on unix and system32/drivers/etc/hosts
on windows):
127.0.0.1 test-450-auction-house.liveauctioneers.com
Then just visit the url with the port of bidder-react: test-450-auction-house.liveauctioneers.com:3443 (Make sure you run npm run stage
locally)
To test on stage follow the similar pattern as above with a few differences:
Here is an article to help configure your hosts file without running into cache issues: https://setapp.com/how-to/edit-mac-hosts-file
The entire site needs to be addressabled at either /*
or /en-gb/*
to facilitate our uk users. All pages of the site need to be routable and navigations must stay within the subpath.
You can toggle the redux client and server loggers in the create.js
file.
Simply toggle the booleans in the createLogger
function as appropriate.
middleware.push(createLogger({ client: true, server: false }));
npm i -g cross-env
npm i --no-save webpack-bundle-analyzer
npx cross-env NODE_ENV=production webpack --colors --display-error-details --config config/webpack/client.analyzer.js
npm i --no-save duplicate-package-checker-webpack-plugin
npx cross-env NODE_ENV=production webpack --colors --display-error-details --config config/webpack/client.dupCheck.js
npm i -g npm-check
npm-check
npm i --no-save lighthouse
npm run dev
npx cross-env LIGHTHOUSE_CHROMIUM_PATH=$(which google-chrome) lighthouse http://localhost:3000 --view
npx webpack --colors --display-error-details --config config/webpack/client.prod.js --profile --json > compilation-stats.json
https://www.akadia.com/services/ssh_test_certificate.html
While in the project's directory:
mkdir sslcert
cd sslcert
openssl genrsa -des3 -out server.key 2048
winpty openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
winpty openssl req -new -key server.key -out server.csr
localhost
as your common name for best results; do not specify portFirst copy the key
cp server.key server.key.org
Then remove the passpharase from the key
openssl rsa -in server.key.org -out server.key
winpty openssl rsa -in server.key.org -out server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
winpty openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
The generated certificate must be imported as a trusted root certificate:
chrome://settings/security?search=manage+certificates
in the URL barhttps://localhost:3000
and/or https://localhost:3001
and bypass the certificate warning, this unlocks the local bundler delivery over SSLhttps://localhost:3443
and bypass the certificate warning, the LiveAuctioneers main page should load without errorshttps://localdev.liveauctioneers.com:3443/
to get cookie support across API services locallySee docs at ./cypress/README.md
FAQs
bidder site written in react.
The npm package bidder-react receives a total of 0 weekly downloads. As such, bidder-react popularity was classified as not popular.
We found that bidder-react demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.