Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
gfw-components
Advanced tools
Showcase of GFW components with the use of react Styleguidist library.
yarn && yarn start
This will set up the app running on port 6060.
Global Forest Watch uses Transifex Live as a tool for translating its applications. If you including the GFW header from a registered domain inside the WRI transifex account you may access this feature. To do so you just need to include the transifex script and API key in the header of your site: https://docs.transifex.com/live/installing-the-javascript-snippet.
The header will then automatically detect the snippet and render the language selector.
Merging PRs to master or pushing commits directly into master triggers Travis CI that checks if the commit is tagged and if it is, it automatically publishes a new version to NPM. To have a full control over the releases, we're tagging the commits locally. To tag a commit and trigger npm publish upon pushing to master, follow these steps:
npm version patch|minor|major -m "Bumping to %s"
git push
to push the commit with bumped version to mastergit push --tags
to push the tagsIf you are importing and building your app with SSR all our components are compatible. You just need to add some global styles to you app to handle the resposnive breakpoints on the server side.
// server.js
import React from "react"
import ReactDOMServer from "react-dom/server"
import express from "express"
import { App } from "./App"
import { mediaStyle } from "./Media"
const app = express()
app.get("/", (_req, res) => {
const html = ReactDOMServer.renderToString(<App />)
res.send(`
<html>
<head>
<title>@artsy/fresnel - SSR Example</title>
<!–– Inject the generated styles into the page head -->
<style type="text/css">${mediaStyle}</style>
</head>
<body>
<div id="react">${html}</div>
<script src='/assets/app.js'></script>
</body>
</html>
`)
})
app.listen(3000, () => {
console.warn("\nApp started at http://localhost:3000 \n")
})
FAQs
React component library for the Global Forest Watch project.
The npm package gfw-components receives a total of 20 weekly downloads. As such, gfw-components popularity was classified as not popular.
We found that gfw-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.