
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
ele-tree-select
Advanced tools
https://github.com/walkalonelxy/ele-tree-select
npm i ele-tree-select -S
在 main.js 中引入
import EleTreeSelect from 'ele-tree-select'
import 'ele-tree-select/lib/ele-tree-select.css'
Vue.use(EleTreeSelect)
| 属性 | 说明 | 类型 | 是否必传 | 默认值 | 可选值 |
|---|---|---|---|---|---|
| props | 配置选项 | object | 否 | 见下面配置选项 | -- |
| code | 作为组件的唯一标志返回 | string | 否 | -- | -- |
| treeData | 作为组件的数据传入,如果开启懒加载,需要将异步获取的数据组装成树型数据传入 | array | 是 | -- | -- |
| clearable | 是否可清空选项 | boolean | 否 | true | false |
| accordion | 是否每次只打开一个同级树节点展开 | boolean | 否 | false | true |
| multipleChoice | 是否多选,暂时只支持多选 | boolean | 否 | true | true |
| lazy | 是否使用懒加载 | boolean | 否 | false | true |
| checkStrictly | 多选时是否父子节点不互相关联 | boolean | 否 | true | false |
| filterable | 是否可搜索 | boolean | 否 | false | true |
| placeholder | 设置搜索框的placeholder | string | 否 | 查找关键字 | -- |
| 参数 | 说明 | 类型 | 默认值 |
|---|---|---|---|
| value | -- | string | id |
| label | -- | string | title |
| children | -- | string | children |
| isLeaf | -- | string | leaf |
| 事件名称 | 说明 | 回调参数 |
|---|---|---|
| lazyLoad | 懒加载时触发的事件 | node:点击的节点对象,resolve:在异步请求结束后需要resolve请求的结果,code:对应上面的code属性 |
| getCheckedData | 获取选中项的value | value:选中节点的value,code:对应上面的code属性 |
| getCheckedItem | 获取选中节点的对象 | data:选中节点的对象,code:对应上面的code属性 |
| 方法名称 | 说明 | 参数 |
|---|---|---|
| clear | 清空所有选中的数据 | -- |
| removeTag | 移除指定的选中项 | value:props里面value映射的字段 |
FAQs
一个基于elementUI的下拉树选择插件
We found that ele-tree-select demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.