
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
comment-extensible
Advanced tools
A React.js package for handling comments, supporting one level of replies and being database agnostic.
This ReactJS package provides a comments component with one level deep replies. It is designed to be database agnostic, supporting MongoDB and PostgreSQL and more...
To install the package, use npm or yarn:
npm install comment-extensible
# or
yarn add comment-extensible
Configure MongoDB Connection
Create a file mongoConfig.ts:
export const mongoConfig = {
mongoDBUrl: "your-mongodb-url",
dbName: "your-database-name",
collectionName: "comments",
};
Ensure MongoDB is running and the connection URL is correctly set.
Configure PostgreSQL Connection
Create a file postgresConfig.ts:
export const postgresConfig = {
user: "your-db-user",
host: "your-db-host",
database: "your-database-name",
password: "your-db-password",
port: 5432,
};
Ensure PostgreSQL is running and the connection parameters are correctly set.
Here's how you can use the Comment component in your React application for Mongo & Postgres:
// App.js
"use client";
import { CommentSection, MongoCommentRepository } from "comment-extensible";
export default function Home() {
const { mongoDBUrl, dbName, collectionName } = {
mongoDBUrl: "mongodb://localhost:27017",
dbName: "comment-extensible",
collectionName: "comment",
};
const commentRepository = new MongoCommentRepository(
mongoDBUrl,
dbName,
collectionName
);
return <CommentSection commentRepository={commentRepository} />;
}
// App.js ⚠️⚠️⚠️ Work in progress - will be out in the next version
"use client";
import { CommentSection, PostgresCommentRepository } from "comment-extensible";
export default function Home() {
const poolOptions = {
user: "postgres",
host: "localhost",
database: "comment-extensible",
password: "YOUR_PASSWORD",
port: 5432,
};
const commentRepository = new PostgresCommentRepository(poolOptions);
return <CommentSection commentRepository={commentRepository} />;
}
We welcome contributions to enhance this package. To contribute, follow these steps:
Fork the repository on GitHub.
Clone your fork locally:
git clone https://github.com/PiusLucky/comment-extensible.git
Create a new branch for your feature or bugfix:
git checkout -b feature/your-feature-name
Make your changes and commit them:
git add .
git commit -m "Add your commit message"
Push your changes to your fork:
git push origin feature/your-feature-name
Create a Pull Request on GitHub.
Please read our Code of Conduct before contributing to ensure respectful collaboration.
Before submitting a pull request, ensure that all tests pass:
npm test
# or
yarn test
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
A React.js package for handling comments, supporting one level of replies and being database agnostic.
The npm package comment-extensible receives a total of 1 weekly downloads. As such, comment-extensible popularity was classified as not popular.
We found that comment-extensible demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.