
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
A command line tool for developing React Native apps
Haul is a drop-in replacement for react-native CLI built on open tools like Webpack. It can act as a development server or bundle your React Native app for production.
Start by adding Haul as a dependency to your React Native project (use react-native init MyProject to create one if you don't have a project):
yarn add --dev haul
# Traditionalist? No problem:
npm install --save-dev haul
To configure your project to use haul, run the following:
yarn haul init
# npm >= 5.2.0 :
npx haul init
# npm < 5.2.0 :
npm install -g npx
npx haul init
This will automatically add the configuration needed to make Haul work with your app, e.g. add webpack.haul.js to your project, which you can customise to add more functionality.
Next, you're ready to start the development server:
yarn haul start -- --platform ios
# Or:
npx haul start --platform ios
Finally, reload your app to update the bundle or run your app just like you normally would:
react-native run-ios
Check out the docs to learn more about available commands and tips on customizing the webpack configuration.
Please refer to the Setup guide.
Haul uses a completely different architecture from React Native packager, which means there are some things which don't work quite the same.
We are actively working on adding support for the following:
Currently we don't support delta bundles (metro feature) (Android). To make Haul work with RN 0.52+, you have to disable that feature - During development, bring up Dev Menu (cmd + m), select Dev Settings and uncheck Delta bundles
react-native commandsThe following features are unlikely to be supported in the future:
node_modules: transpile your modules before publishing, or configure webpack not to ignore themThanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Haul is a new command line tools for React Native
The npm package haul receives a total of 64 weekly downloads. As such, haul popularity was classified as not popular.
We found that haul demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.