
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
RNPlus 是 React Native 的前端拓展框架,简化并增强前端开发。
配合使用 rnxDemo,阅读该文档,风味更佳哦~
// 引入 RNPlus
import {
PView,
PComponent,
} from 'rnplus';
// 定义一个页面
class PageA extends PView {
// ...
};
// 定义一个组件
class MyComp extends PComponent {
// ...
};
开发者可以通过 class Demo extends PView {} 或 class Demo extends PComponent {} 的方式创建 RNPlus View 或 Component,并使用 RNPlus 的插件。
例:
class Demo extends PView {
render() {
return <Text>Hello, RNPlus!</Text>
}
}
注意:
不要修改对 PView 和 PComponent 的引用。以下写法是无效的:
// 无效的写法
const MyView = PView;
class Demo extends MyView {
render() {
return <Text>Hello, RNPlus!</Text>
}
}
之所以这样是因为 RNPlus 为方便开发,会通过配套的 babel 插件自动完成注册。如果你一定要像上面那样,你也可以通过以下方式手动完成注册:
const MyView = PView;
class Demo extends MyView {
render() {
return <Text>Hello, RNPlus!</Text>
}
}
// 手动注册
Demo = RNPlus.register(Demo, 'Demo');
全局配置,用户可以配置一些全局的设置。
默认配置:
RNPlus.defaults = {
appName: '',
globalPlugins: ['router', 'redux'],
};
暂见各自 README.md
添加插件
name:{String} 插件名adapter: {Function} 适配器ininFn: {Function} RNPlus 初始化回调函数registerFn: {Function} PView/PComponent 注册时回调函数示例
RNPlus.addPlugin('xxx', (Comp, opts, React, isView) => {
// Comp : React Comp 组件实例
// opts : 插件配置
// React : React 对象
// isView : 是否是 View (有可能是 Component)
}, (React) => {
// React : React 对象
}, (RNPlusComp, isView) {
// RNPlusComp : RNPlus Comp 组件 Class (PView/PComponent)
// isView : 是否是 View (有可能是 Component)
});
FAQs
React Native Plus
The npm package rnplus receives a total of 8 weekly downloads. As such, rnplus popularity was classified as not popular.
We found that rnplus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.