
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A JavaScript-only React Native chat interface module built for Expo. This package provides a flexible and easy-to-use chat UI component that can be integrated into any React Native application.
npx expo install dexbox-react-native
npm install dexbox-react-native
This package uses a development workflow that allows for quick iterations and live testing through the example app.
npm install
The example app is the best way to develop and test changes to the module:
Navigate to the example directory:
cd example
Install example app dependencies:
npm install
Start the development server:
npm start
Run on your preferred platform:
npm run ios
# or
npm run android
The module is set up for live development:
src/ directoryTo release a new version:
Update the version number in package.json
Build the module:
npm run build
This will:
Publish to npm:
npm publish
src/
├── components/ # UI components
├── assets/ # Fonts and other static assets
├── utils/ # Helper functions
└── index.ts # Main entry point
FAQs
Dex AI assistant Chat UI for React Native
We found that dex-rn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.