
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-lightning-design-system
Advanced tools
Salesforce Lightning Design System components built with React
Salesforce Lightning Design System components built with React.
See the demo.
$ npm install react-lightning-design-system
import React from 'react';
import ReactDOM from 'react-dom';
import { Button } from 'react-lightning-design-system';
function click() { alert('Clicked'); }
ReactDOM.render(
<div>
<Button onClick={ click }>Simple</Button>
<Button type='neutral' onClick={ click }>Neutral</Button>
<Button type='brand' onClick={ click }>Brand</Button>
<Button type='neutral' icon='download' iconAlign='left' onClick={ click }>Icon #1</Button>
<Button type='neutral' disabled>Disabled Neutral</Button>
<Button type='brand' disabled>Disabled Brand</Button>
</div>
, document.body);
See more examples in examples directory.
This repo ships with a react storybook based story scripts. To run stories and get component examples, follow these steps:
npm installnpm run storybookThis repo ships with story snapshots to examine differences in rendering as a result of changes to source code.
To identify render differences run npm run test:storyshots. If all changes are intentional run npm run test:storyshots -- -u. To learn about other run options including interactive mode, read
Snapshot Testing in React Storybook
FAQs
Salesforce Lightning Design System components built with React
We found that react-lightning-design-system demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.