
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
coachlist-widgets
Advanced tools
This package contains all widgets for coachlist and coachlist pro. Available Widgets:
Install the package as a dependency.
npm i coachlist-widgets
Here is a guide to integrate widgets into your application:
Note: Don't forget to import styles: import 'coachlist-widgets/dist/cjs/main.css'
import BookingWidget from "coachlist-widgets"
import 'coachlist-widgets/dist/cjs/main.css'
const YourComponent = () => {
return (
<>
<BookingWidget
onShare={onShare}
baseURL={baseURL}
selectedSport={selectedSport}
handler={handler}
nickname={nickname}
sportsID={sportsID}
onSessionSelectionChange={onSessionSelectionChange}
/>
</>
)
}
export default YourComponent
Prop Types
nickname: string
sportsID?: string
selectedSport?: string
onShare?: (data: any) => void
baseURL: string
onSessionSelectionChange: (data: any) => void
handler?: {
fetchRecord: () => void
}
######################################
import ISPWidget from "coachlist-widgets"
import 'coachlist-widgets/dist/cjs/main.css'
const YourComponent = () => {
return (
<>
<ISPWidget
authToken={authToken}
baseURL={baseURL}
profileId={profileId}
route={{
currentRoute: string
getCurrentRoute: (route: string) => void
}}
viewProfileClickHandler={viewProfileClickHandler}
/>
</>
)
}
export default YourComponent
Prop Typesp
baseURL: string
profileId: string
authToken: string
route: {
currentRoute: string
getCurrentRoute: (route: string) => void
}
viewProfileClickHandler: (url: string) => void
FAQs
A simple template for a custom React component library
The npm package coachlist-widgets receives a total of 25 weekly downloads. As such, coachlist-widgets popularity was classified as not popular.
We found that coachlist-widgets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.