
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
redux-local
Advanced tools
Redux helper for maintaining pseudo-local state in a single tree.
npm install redux-local --saveWhile there are existing alternatives to managing pseudo-local state in Redux — redux-local adopts the following philosophies:
shouldComponentUpdate;By providing only a handful of functions — localFor and bindLocalState — redux-local doesn't complicate the managing of pseudo-local state in components.
Begin by setting up the default state for the reducer using DEFAULT_STATE:
const INITIAL_STATE = {
[DEFAULT_STATE]: 0
};
Setup the reducer using the id to resolve which component dispatched the action:
export default (state = INITIAL_STATE, action) => {
const { id } = action;
const getState = bindLocalState(state);
switch (action.type) {
case INCREMENT:
return { ...state, [id]: getState(id) + 1 };
}
return state;
};
Destructure the id and dispatcher for the component, and then invoke localDispatch with your action:
render() {
const { counter } = this.props;
const { id, dispatch: localDispatch } = localFor(this);
return (
<div onClick={() => localDispatch(incrementAction())}>
{counter[id]}
</div>
);
}
It's worth taking a look at how the example Counter component works with redux-local, as well as the source which is intended to be straight-forward.
bindLocalState: Is a helper function that takes the state and yields the state slice that pertains to the passed action by using the unique id property. Returns DEFAULT_STATE if the id doesn't yet exist in state;localFor: Takes the component instance — this — and yields both the unique id for the component — or DEFAULT_STATE if no local dispatches have yet occurred — and the dispatch function which appends the id to the action.Note: The localFor function takes an optional second parameter for passing the id property name for the action.
FAQs
Redux helper for maintaining pseudo-local state in a single tree.
We found that redux-local demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.