
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Panza (named after Sancho Panza, from Don Quixote), is a collection of stateless, functional ui-components for react-native, and heavily inspired by the excellent rebass library.
The goal with Panza is to provide a set of commonly used (mostly) functional ui components for react-native, that work well in both android and iOS environments. These components should look nice out of the box, but still offer a high degree of customization. This is achieved primarily through the use of composition. Each component is comprised of smaller components including a Base component, which provides some nice shorthands to transform props into styles based upon a global configuration. A component like TouchableRow may suit your needs eighty percent of the time, but in cases where you need something a bit more custom, you can construct your own row using TouchableRowCell, PrimaryText, SecondaryText, RowImage, Base, ArrowRightIcon, and any other components that you’d like.
You can see Panza in production with Payback, an app that manages shared expenses between individuals and groups.
$ npm i panza --save
$ npm i react-native-vector-icons --save
$ rnpm link react-native-vector-icons
You can override parts of the global configuration to provide custom colours, font sizes, scales, etc.
import { config } from 'panza'
class App extends React.Component {
static childContextTypes = {
panza: PropTypes.object
}
getChildContext() {
panza: this.state.styles
}
state = {
styles: {
colors: Object.assign(
{},
config.colors,
{ primary: config.colors.red } // change the primary color from blue to red
)
}
}
// ... render your app
}
You can install the example application contained within this repository.
$ git clone https://github.com/bmcmahen/panza.git
$ cd panza && npm install
$ react-native run-ios
$ react-native run-android
MIT
FAQs
a foundation for your react-native projects
We found that panza demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.