
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A Svelte component library for composing responsive interactive data visualisations.
A Svelte component library for composing responsive interactive data visualisations.
https://github.com/olihawkins/sveltevis
This package is in active development. The API should be regarded as unstable until version 1.0.0. The package supports Svelte 5 and TypeScript.
The goal of the project is to provide a Svelte component library that allows you to quickly compose a responsive interactive visualisation from a set of components and a JSON object that specifies their behaviour. The components include standard chart elements like axes and gridlines, along with geometries that map input data to a specfific visual representation (e.g. points, lines, bars, areas). The library is extensible, so if you want to implement a new kind of visualisation you only need to implement a new geometry for the kind of data represention you want to create. All of the infrastructure for handling responsiveness and interactivity is available via the parent Visualisation component's shared context.
The project currently contains the components needed to make responsive scatterplots and line charts. It also includes a system for sending messages between components about events, which is used to implement a Popup component.
VisualisationHeaderFooterGraphicSvgGridlinesAxisXAxisYPlotCircleGeometryLineGeometryPopupColorSchemeObserverIf you want to try the existing components, the easiest way right now is to download and run the demo project.
Clone the project repository from GitHub
Run npm install to install the dependencies
Run npm run dev to start the demo application on localhost:5173
It is also possible to install the package from NPM into a Vite Svelte template.
Create a Svelte project with Vite using npm create vite@latest my-svelte-project -- --template svelte
Run npm install to install the dependencies
Install the package with npm install sveltevis
SvelteVis allows you to target the styles used in its components using your own stylesheet, so that the styles of your visualisations match your website. Importing SvelteVis components into a new project doesn't automatically add the default styles used in the demo application. However, if you want to use these stylesheets as a starting point for making modifications, they can be found in the css folder: simply copy them as stylesheets to use in your own app.
The stylesheet for targeting SvelteVis components is called sveltevis.css and this is the stylesheet you should modify to implement your own visualisation styles. The site.css stylesheet is the css used for the demo application, and it doesn't contain any of the selectors used to target the visualisation components. Both of these default stylesheets are set up to provide alternate light and dark styles based on the operating system mode.
FAQs
A Svelte component library for composing responsive interactive data visualisations.
We found that sveltevis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.