
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@pdftron/sanity-code-input
Advanced tools
This is a Sanity Studio v2 plugin. For the v3 version, please refer to the v3-branch.
Code input for Sanity.
Currently only a subset of languages and features are exposed, over time we will implement a richer set of options.
yarn add @sanity/code-input@studio-v2
Next, add "@sanity/code-input" to sanity.json plugins array:
"plugins": [
"@sanity/code-input"
]
Use it in your schema types:
// [...]
{
fields: [
// [...]
{
name: 'exampleUsage',
title: 'Example usage',
type: 'code',
},
]
}
Note that the above only works if you import and use the all:part:@sanity/base/schema-type part in your schema.
language - Default language for this code fieldlanguageAlternatives - Array of languages that should be available (se its format in the example below)theme - Name of the theme to use.
['github', 'monokai', 'terminal', 'tomorrow'].withFilename - Boolean option to display input field for filename// ...fields...
{
name: 'exampleUsage',
title: 'Example usage',
type: 'code',
options: {
theme: 'solarized_dark',
language: 'js',
languageAlternatives: [
{title: 'Javascript', value: 'js'},
{title: 'HTML', value: 'html'},
{title: 'CSS', value: 'css'},
{title: 'Rust', value: 'rust', mode:'rust'},
{title: 'SASS', value: 'sass'},
]
}
}
Only a subset of languages are supported by default (see full list here). You can add support for other languages by importing the ace mode yourself, and specifying mode for the languageAlternatives schema config.
Example: Add support for the Rust Programming Language
// import rust support for ace, see https://github.com/securingsincity/react-ace for more details
import 'ace-builds/src-noconflict/mode-rust'
{
name: 'exampleUsage',
title: 'Example usage',
type: 'code',
options: {
languageAlternatives: [
{title: 'Javascript', value: 'js'},
{
title: 'Rust',
value: 'rust',
mode:'rust' // <- specify the mode to use here. Make sure this mode is also imported from ace-builds (see above)
},
]
}
}
{
_type: 'code',
language: 'js',
highlightedLines: [1, 2],
code: 'const foo = "bar"\nconsole.log(foo.toUpperCase())\n// BAR'
}
You can use any syntax highlighter you want - but not all of them might support highlighted lines or the syntax you've defined.
As outlined above, the actual code is stored in a code property, so if your schema has a field called codeExample of type code, the property you'd want to pass to the highlighter would be codeExample.code.
Here's an example using react-refractor:
import React from 'react'
import Refractor from 'react-refractor'
import js from 'refractor/lang/javascript'
Refractor.registerLanguage(js)
export function Code(props) {
return (
<Refractor
// In this example, `props` is the value of a `code` field
language={props.language}
value={props.code}
markers={props.highlightedLines}
/>
)
}
export default Code
Other syntax highlighters include:
MIT-licensed. See LICENSE.
FAQs
Ace editor for editing code
The npm package @pdftron/sanity-code-input receives a total of 2 weekly downloads. As such, @pdftron/sanity-code-input popularity was classified as not popular.
We found that @pdftron/sanity-code-input demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.