
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
tocco-client
Advanced tools
This repository contains the web client for the Tocco Business Framework.
This project is based on following technologies, tools and libraries:
Initial project structure is based on: https://github.com/davezuko/react-redux-starter-kit.
This project uses Lerna for package management. The repository is maintained as monorepo.
Packages are located in folder packages/. Every package maintains its own dependencies
and can be re-used in other packages.
tocco-... naming is used in package.json; in folder structure tocco- prefix can be omittedPlease ensure that every package is prefixed with tocco-
tocco-uiPackage tocco-ui is a collection of reusable components. Components can be seen in action in the
showcase-app deployed on GitHub. Content of this page
is re-generated by Travis-CI on any change to packages tocco-ui or tocco-ui-showcase.
Since this project heavily uses Redux and Sagas, you should be aware of it's concepts and also ES6. A good starting point can be found in these docs:
Just install yarn https://yarnpkg.com/en/docs/install and execute the following commands:
npm install --global lerna@v2.9.1
npm run setup
lerna bootstrap
yarn start --package={PACKAGE_NAME}
Open http://localhost:3000 and start coding!
Add --noMock parameter to disable mocked data.
In this case you must run the Tocco Business Framework application with enabled REST API on:
http://localhost:8080
Tests are using following tools and libraries:
All packages:
npm test
Single Package:
yarn test --package={PACKAGE_NAME}
During development with watch:
yarn test:dev --package={PACKAGE_NAME}
The project provides some code generators. Generators are developed with Plop and can be executed with:
npm run plop
At the moment there is a generator to create a react-component and a generator to add a redux-action.
Once the package is ready to publish, run following npm scripts. This registers the bundle in the npm registry, increases versions and creates a git tag. Scope flag is optional and allows you to publish a subset of packages.
lerna publish [--scope {PACKAGE_NAME}] --exact -m "chore: publish"
Only build:
yarn compile:dev --package={PACKAGE_NAME}
yarn compile:prod --package={PACKAGE_NAME}
Optional a --analyze parameter can be added to open webpack-analyzer to investigate the bundle size.
Eslint is used for linting. Linting will also be executed automatically on our CI.
npm run lint
And automatically fix issues:
npm run lint:fix
pr/{package}-{description-of-contribution}Similar to Karma commit messages follow this convention:
<type>(<scope>): <subject>
<body>
First line must not be longer than 70 characters, second line is always blank and other lines should be wrapped at 80 characters.
Allowed <type> values:
Example <scope> values:
FAQs
Monorepo for the Tocco client
The npm package tocco-client receives a total of 0 weekly downloads. As such, tocco-client popularity was classified as not popular.
We found that tocco-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.