
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
hmi_react-native-share
Advanced tools
Social share, sending simple data to other apps. Forked to allow sharing URLs/URIs - HeresMyInfo invitations
React Native Share, a simple tool for share message and file to other apps.
If you use this library on your commercial/personal projects, you can help us by funding the work on specific issues that you choose by using IssueHunt.io!
This gives you the power to prioritize our work and support the project contributors. Moreover it'll guarantee the project will be updated and maintained in the long run.
If you are using react-native >= 0.60 you just need to do a simple:
yarn add react-native-share
Or if are using npm:
npm i react-native-share --save
After that, we need to install the dependencies to use the project on iOS(you can skip this part, if you are using this on Android).
Now run a simple: npx pod-install or cd ios && pod install. After that, you should be able to use the library on both Platforms, iOS and Android.
Then simply import:
import Share from 'react-native-share';
Share.open(options)
.then((res) => {
console.log(res);
})
.catch((err) => {
err && console.log(err);
});
Which you do something similar to this:

If you are using a older version of react-native or react-native-share, having any problem or want to know how use Share.open and other functions, please refer to our new docs and help us improve that. ❤️
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.