
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
deku-stateful
Advanced tools
Keep state in Deku components
Deku v2 has no states in components. This is a higher-order component that adds state and setState to the model.
See this conversation here.
Compatible with Deku 2.0.0 (tested with 2.0.0-rc11) and Decca 2.0.0.
import stateful from 'deku-stateful'
function initialState () {
return { clicked: 0 }
}
function render ({ getState, setState }) {
return <div>
Clicked { getState().clicked } times.
<button onClick={ () => setState({ clicked: getState().clicked + 1 }) }>
Click me
</button>
</div>
}
export default stateful({ initialState, render })
The render function and the lifecycle hooks will also be passed getState and setState.
function render({ getState, setState }) {
}
setState(object) — Updates the state when called. When setState is ran, it will queue up changes and dispatch an event like dispatch({ type: 'UI_STATE_CHANGE' }). This is meant to be picked up by your Redux store, which we're assuming will retrigger a render() when called.getState() — Returns the current state.state — The current state; it's preferred to use getState() instead, but it's here for legacy compatibility.Your component can have an initialState function. Return the first state here.
function initialState ({ props }) {
return { clicked: false }
}
export default stateful({ initialState, render })
deku-stateful © 2016+, Rico Sta. Cruz. Released under the MIT License.
Authored and maintained by Rico Sta. Cruz with help from contributors (list).
ricostacruz.com  · GitHub @rstacruz  · Twitter @rstacruz
FAQs
Keep states in a Deku component
We found that deku-stateful demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.