
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-arconnect
Advanced tools
<code>@decentldotland/react-arconnect</code> React hooks for Arweave wallets (with support for ArConn
@decentldotland/react-arconnectReact hooks for Arweave wallets (with support for ArConnect and arweave.app)
Add it to your project:
yarn add react-arconnect
//App.js | index.js
import React from 'react';
import { ArconnectProvider, ArconnectContext } from 'react-arconnect';
//wrap the root component with <ArconnectProvider />
export default function Home() {
const permissions = ["ACCESS_ADDRESS"]
return (
<ArconnectProvider permissions={permissions}>
<Name />
</ArconnectProvider>
)
}
This is the provider component. It should be placed above all components using useArconnect().
This is the hook to be used throughout the app. It returns an object containing:
PermissionType[]: Array of permissions granted to the site by the connected Arconnect wallet.boolean: ArConnect wallet connection state.string: Wallet address of the currently connected Arconnect wallet.Learn more about ANS (Arweave Name service)
Returns:
address_color: The ANS profile color.currentLabel: The current ANS label in use.avatar: The TXID for the ANS Avatar Image.Usage:
const data = new TextEncoder().encode('test message');
const signature = await createSignature(data);
// fQYlCxQSkgGMQdWnUZqAr3bu78GE2f9fa6i35+PzTg...S+fNDCjt0O/w9tOzHn45+UqmeWZ9kLzn2LyE=
lIg5..._3Qgstring: Permission type for the ArConnect wallet permissions.PermissionType[]: All permissions available for the Arweave-based wallets.object: Default signature params for the createSignature function.string: API route for ANS (Arweave Name service) that returns all domains belonging to the wallet address.Usage: https://ans-resolver.herokuapp.com/resolve-as-arpage/kaYP9bJtpqON8Kyy3RbqnqdtDBDUsPTQTNUCvZtKiFI
(deprecation notice: The URL will be swapped out in coming updates)
To run the examples, switch to the respective directories. Run npm install or yarn install, Then run npm start dev or yarn dev.
Check out our example app and components to see how to use react-arconnect in your app.
This project is licensed under the MIT license
FAQs
<code>@decentldotland/react-arconnect</code> React hooks for Arweave wallets (with support for ArConn
We found that react-arconnect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.