
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
lazy-input
Advanced tools
A lazy React.js input field that only updates when it is told to re-render (fixes issues with Flux backed field data)
A lazy React.js input field that only updates when it is told to re-render (fixes issues with Flux backed field data)
Using input elements with Flux can be a pain because actions are asynchronous. Triggering an action in the onChange handler will cause React's default input component to re-render the original value miliseconds before the new value arrives from the store.
LazyInput solves this problem by keeping an internal state for value and only updates that state when given new props, and then only after a lazyLevel has lapsed (default 1s). Otherwise, it works exactly like input. Well, almost. . .
LazyInput expands the type prop slightly to accept textarea in addition to the normal input types. We chose to do it this way because it seemed better than maintaining two packages (LazyInput and LazyTextarea), having lazy-input/input and lazy-input/textarea require statements, or having LazyInput.input and LazyInput.textarea.
var LazyInput = require('lazy-input');
// ...
render: function() {
return (
<div>
// an input element
<LazyInput type="text" value="some value" onChange={this.onChange} />
// a test area element
<LazyInput type="textarea" value="some value" onChange={this.onTextAreaChange} />
</div>
);
}
LazyInput can also accept any React Component as the type. For example, if you are using the react-input-placeholder to get placeholder working in older browsers (ex. IE9), then you can pass through the input component directly. There is plenty of rope here to hang yourself though, so be careful.
var Input= PlaceholderShim.input;
// ...
<LazyInput type={Input} value="some value" onChange={this.onChange} />
Installing via npmjs
npm install --save lazy-input
Using
LazyInput = require('lazy-input');
// ...
<LazyInput type="text" value={this.state.myFluxValue} onChange={this.onChange} />
git clone https://github.com/HurricaneJames/lazy-input.git
cd lazy-input
npm install
npm run examples
open localhost:8090
v2.0 - Updated to support React 15.x, added examples
v1.1 - LazyInput types can now include any React Component class. Thanks go to Riku Rouvila.
FAQs
A lazy React.js input field that only updates when it is told to re-render (fixes issues with Flux backed field data)
The npm package lazy-input receives a total of 17 weekly downloads. As such, lazy-input popularity was classified as not popular.
We found that lazy-input demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.