
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@saran-ign/react-image-annotate
Advanced tools
Fork of react-image-annotate - The best image/video annotation tool ever. Check out the demo here. Or the code sandbox here.
Implemented features in fork:

npm i @saran-ign/react-image-annotate
import React from "react";
import ReactImageAnnotate from "@saran-ign/react-image-annotate";
const App = () => (
<ReactImageAnnotate
onExit={() => {
console.log("exit");
}}
regionClsList={["Alpha", "Beta", "Charlie", "Delta"]}
regionTagList={["tag1", "tag2", "tag3"]}
images={[
{
src: "https://placekitten.com/408/287",
name: "Image 1",
regions: []
}
]}
/>
);
export default App;
To get the proper fonts, make sure to import the Inter UI or Roboto font, the following line added to a css file should suffice.
@import url("https://rsms.me/inter/inter.css");
All of the following properties can be defined on the Annotator...
| Prop | Type (* = required) | Description | Default |
|---|---|---|---|
taskDescription | *string | Markdown description for what to do in the image. | |
allowedArea | { x: number, y: number, w: number, h: number } | Area that is available for annotation. | Entire image. |
regionTagList | Array<string> | Allowed "tags" (mutually inclusive classifications) for regions. | |
regionClsList | Array<string> | Allowed "classes" (mutually exclusive classifications) for regions. | |
regionTagSingleSelection | boolean | Allowed select only one tag for image. | |
regionAllowedActions | {remove?:boolean, lock?:boolean, visibility?: boolean | Allowed actions for region in regions list. | Everything. |
imageTagList | Array<string> | Allowed tags for entire image. | |
imageClsList | Array<string> | Allowed classes for entire image. |
| classificationTitle |<string> | Allowed classes for entire image. | |
| enabledTools | Array<string> | Tools allowed to be used. e.g. "select", "create-point", "create-box", "create-polygon" | Everything. |
| showTags | boolean | Show tags and allow tags on regions. | true |
| selectedImage | string | URL of initially selected image. | |
| images | Array<Image> | Array of images to load into annotator | |
| showPointDistances | boolean | Show distances between points. | false |
| pointDistancePrecision | number | Precision on displayed points (e.g. 3 => 0.123) | |
| onExit | MainLayoutState => any | Called when "Save" is called. | |
| RegionEditLabel | Node | React Node overriding the form to update the region (see RegionLabel) | |
| allowComments | boolean | Show a textarea to add comments on each annotation. | false |
| hidePrev | boolean | Hide Previous Image button from the header bar. | false |
| hideNext | boolean | Hide Next Image button from the header bar. | false |
| hideClone | boolean | Hide Clone button from the header bar. | false |
| hideSettings | boolean | Hide Settings button from the header bar. | false |
| hideFullScreen | boolean | Hide FullScreen/Window button from the header bar. | false |
| hideSave | boolean | Hide Save button from the header bar. | false |
Change theme : localStorage.setItem("_annotate_bgColor", "black")
This project uses react-storybook. To begin developing run the following commands in the cloned repo.
yarn installyarn add react react-domreact and react-dom packages and
run yarn build - it fix the issue with react and react-dom versions in your project.A browser tab will automatically open with the project components.
See more details in the contributing guidelines.
Consult these icon repositories:
FAQs
An Image Annotate Library for React
We found that @saran-ign/react-image-annotate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.