
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
watson-ui-components
Advanced tools
UI components (CSS & SCSS) used in Watson Developer Cloud demo apps
The Watson Platform Component Library is a Sass library that translates Watson design language into UI components to help develop web UI.
Demo: https://watson-developer-cloud.github.io/ui-components/
$ npm install watson-ui-components
All needed CSS, images, and javascript are found in /dist.
In Sass, you just need to import the sass file:
@import 'watson-ui-components/dist/_watson-ui-components.scss';
Make sure node_modules is a loaded path so that sass can find the route above.
npm install
gulp
You will need to make sure the icon-fonts are referenced properly. The path of the icon-fonts must be relative to the path of the compiled css file.
You will also need to make sure to load the paths of your node_modules directory into your Sass configurations, so that the library can reference its npm dependencies properly.
.
└─ dist
├── _watson-ui-components.scss // Compiled Sass
├── watson-ui-components.css // Compiled css
└── watson-ui-components.min.css
This project could not have been made possible without the hard work from the team that worked on the previous Watson Design Guide. Many concepts and Sass techniques were borrowed from their project, while others were modified.
FAQs
UI components (CSS & SCSS) used in Watson Developer Cloud demo apps
We found that watson-ui-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.