
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@verida/client-rn
Advanced tools
This is the Verida Client (Typescript) library compatible with NodeJs and modern web browsers.
This is the Verida Client (Typescript) library compatible with NodeJs and modern web browsers.
See @verida/client-rn for a React Native version of this library.
Install the library:
yarn add @verida/client-ts
See the Client SDK Getting Started Guide in the Developer Docs.
Initialize a connection to the Verida network with an existing private key.
See the Authentication with a Private Key.
See the Advanced Authentication.
There are unit tests available in the tests/ folder.
$ yarn run tests
$ yarn run tests test/<testname>.ts
Verida DID Server (run locally)
The tests require running a local instance of the Verida DID server to support managing DIDs.
Start a storage node server
You must run the [Datastore server](https://github.com/verida/storage- node) locally so there is a CouchDB instance for your test data.
Run the following in a new terminal within the storage-node directory:
$ npm install
$ npm run start
Running tests
You can now run tests from within the client-ts directory:
$ yarn run tests // run all tests
$ yarn run test test/storage.context.tests.ts // run a specific test
These instructions build this client-ts package in the mono repo and allow it type be linked to another typescript web application (such as @verida/web-sandbox).
$ cd packages/client-ts
$ yarn install
$ yarn build
$ yarn link
Within an existing typescript web project:
$ yarn link @verida/client-ts
$ yarn run serve
yarn generate-api-docs
FAQs
This is the Verida Client (Typescript) library compatible with NodeJs and modern web browsers.
The npm package @verida/client-rn receives a total of 47 weekly downloads. As such, @verida/client-rn popularity was classified as not popular.
We found that @verida/client-rn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.