
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-native-component-cli
Advanced tools
Many repositories of react native component are not well structured and missing basic parts in CI / CD workflow including development setup, testing, lint... react-native-component-cli helps to instantly scaffold a react-native-component project with following features:
If you are using an NPM version before 5.2.0, install
npxwith the following cmd
$ npm install npx -g
$ npm install react-native-component-cli -g
$ npm install expo-cli -g
$ npx react-native-component-cli create
$ rnc create

$ cd path-to-your-react-native-component
$ npm install
$ npm test
$ npm start
react-native-example-component
├── demo // contains an Expo project for dev
│ ├── App.js // the main file for develop the Expo project
│ ├── AppEntry.js // the entry point for the Expo project
│ ├── app.json // the Expo project config
│ └── metro.config.js // the metro bundler config
├── src // contains source file(s) for the component
│ └── index.js
├── test // contains test file(s) for the component
│ └── index.test.js
├── .eslintrc.js // the eslint config for the component
├── babel.config.js // the babel config for the test & Expo environments
├── setup-tests.js // the jest-setup file for Enzyme
├── README.md // README for the component
├── .gitignore // git ignore for the component
└── package.json // pacakge.json for the component
MIT
FAQs
scaffold a react native component within seconds
The npm package react-native-component-cli receives a total of 8 weekly downloads. As such, react-native-component-cli popularity was classified as not popular.
We found that react-native-component-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.