
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@datapunt/asc-core
Advanced tools
asc-coreThis package contains the re-exported version of styled-components, typed with the theme configuration.
We seperate this package from asc-ui to leave open the possibility of using other variants of styled-components (eg. styled-components-vue).
This way the styled components can be compiled framework / library agnostic, if we decide to support vue for example in the near future. Only the tsconfig in this project should point to the right file, something like index.vue.ts (instead of index.ts, which is react).
Simply use the core library like this:
import styled, { Theme } from '@datapunt/asc-core'
export type Props = {
color?: Theme.ColorType; // <-- theme typings!
}
styled.p`` // <-- theme typed styled component!
styled points to a re-exported version of styled-components, that could either be the react variant (default) or another one.
To add a new theme:
src/theme/<new-theme-name>src/theme/index.tsimport { ThemeProvider } from '@datapunt/asc-core'
<ThemeProvider themeName={`<new-theme-name>`}>
<App />
</ThemeProvider>
To override some of the theme properties
laptopM breakpoint and redefine the primary and secondary colorsimport { ThemeProvider } from '@datapunt/asc-core'
const themeOverides = {
breakpoints: {
laptopM: () => '(min-width: 800.02px)',
},
colors: {
primary: {
main: '#00887a',
},
secondary: {
main: 'green',
},
},
}
<ThemeProvider overrides={themeOverides}>
<App />
</ThemeProvider>
FAQs
Contains the re-exported typed styled-component lib and theme
The npm package @datapunt/asc-core receives a total of 72 weekly downloads. As such, @datapunt/asc-core popularity was classified as not popular.
We found that @datapunt/asc-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.