
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
A very simple user interface toolkit for teaching UI architecture.
There are three main ways to use SimpleKit.
The npm package is updated less frequently than the GitHub repo, but it's still a good way to use SimpleKit, especially if you already have a TypeScript build process.
Once you have a node project setup, just:
npm install simplekit
Notes on this approach:
node_modules/
subfolder.npm install
.Clone the SimpleKit repo and install everything with npm install
.
From the root folder of the SimpleKit repo, run:
npm link
This adds a simulated global npm package called "simplekit" (it's literally a symbolic link to the repo folder).
To use the linked package, run the following from your project:
npm link simplekit
Now it will behave as though an official npm package was installed.
Notes on this approach:
any
). A workaround is to run "TypeScript: Restart TS Server" from the Command Palette.Add SimpleKit as a submodule to your project repo. This way it'll be in a known folder path relative to your project source, a good place to put it is in the root. So instead, of digging into node_modules/
you can just examine the simplekit folder of your project.
To import, you can just use a relative path like:
import * from "../../simplekit/src/canvas-mode"
Or, even better, you can setup your build environment to have a path to the simplekit folder. For example in Vite:
Git doesn't automatically init and update submodules automatically, so you'll need to do it on command line the first time you clone your main repo.
FAQs
A very simple user interface toolkit for teaching UI architecture.
The npm package simplekit receives a total of 9 weekly downloads. As such, simplekit popularity was classified as not popular.
We found that simplekit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.