
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
tango-react-components
Advanced tools
cd into itnpm installThis purpose of this project is to provide a scaffolding for developers to quickly create a standalone UI Component and publish it as an internal NPM Package.
If you only need to test your component, just run:
npm start
You can install the package locally like this:
# in this directory
npm run build
npm pack
# copy path to .tgz output by npm pack
# in the project in which you want to install it, the first time:
npm install "your/path/to/tgz/here.tgz"
# if you make updates to package, repeat build & pack, then:
npm install @tenant-ui/package-name
In the root of this project run this line. It will setup a global npm package pointed at this project with the name "@tenant-ui/package-name"
npm link
In the root of the template project that is using the app shell, run this. It will add a reference to the global link (setup in step 1) directly to node_modules in the template project
npm link @tenant-ui/package-name
Then back in this project, we need to make sure we dont reference react twice, so we use the template's version of react. This assumes the shell project folder and the template project folder are siblings in the file system (hense ../)
npm link ../atlas-ui-app-template/node_modules/react
To deploy a new version of this package, push a commit to the master branch. We are using an action to automatically bump the version. The "version": "0.0.0" in package.json is just a placeholder that is replaced during the deployment.
package-version environment variable in .github/workflows/deployment.yml.FAQs
bundled component library
We found that tango-react-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.