# npm packages npm packages are files or directories described by package.json files and published to the npm registry; they commonly contain Node.js modules. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting DevFeed: [PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting]() Original publisher: [Read original article]() Author: Maddie Stewart Published: 2026-09-16T13:36:43.658349Z Content type: news Language: en Sources: [Blog]() Topics: [Malware](), [Large Language Model](), [JavaScript](), [npm](), [npm packages](), [Bug Bounty]() Tags: [bug-bounty](), [javascript](), [llm](), [malware](), [npm](), [npm-packages](), [threat-hunting-intel]() ### AI overview CrowdStrike reports that a financially motivated bug bounty hunter developed and distributed PhantomRaven, a JavaScript-based information stealer through npm. The company assesses with high confidence that a large language model was used to write the malware and says the operator likely used it to identify bug bounty opportunities. ### Source excerpt CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## The Mastra AI Ecosystem Was Poisoned At The Registry Level DevFeed: [The Mastra AI Ecosystem Was Poisoned At The Registry Level]() Original publisher: [Read original article]() Author: Roshan Piyush Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [software supply-chain attack](), [npm packages](), [Malware](), [Artificial Intelligence](), [CI/CD](), [TypeScript](), [Cloud]() Tags: [ai](), [ci-cd](), [malicious-packages](), [malware](), [mastra](), [npm](), [npm-packages](), [software-supply-chain](), [software-supply-chain-attack](), [typescript]() ### AI overview The article examines a June 17, 2026 software supply-chain attack targeting the Mastra AI TypeScript ecosystem. It reports that a compromised contributor account was used to publish 144 malicious packages under the official @mastra npm scope, with registry-level changes introducing the easy-day-js transitive dependency. Installations during the compromise window could expose developer workstations, CI/CD runners, and cloud environments to an information stealer. ### Source excerpt Learn how the Mastra AI supply chain attack poisoned npm packages, impacted AI pipelines, and how Harness SCS helps detect, block, and remediate compromised dep | Blog ## The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware" DevFeed: [The expanding threat landscape: Chainguard now scans source code for traditional malware and "greyware"]() Original publisher: [Read original article]() Published: 2026-06-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Malware](), [Code](), [Open Source](), [npm](), [npm packages](), [Security]() Tags: [chainguard](), [chainguard-libraries](), [ecosystems](), [greyware](), [greyware-scanner](), [hardening](), [javascript](), [malware](), [malware-prevention](), [malware-scanner](), [npm](), [npm-packages](), [open-source](), [packages](), [scanner](), [security](), [source](), [supply-chain-attacks]() ### AI overview Chainguard has introduced a source code scanner that detects traditional malware and "greyware," harmful packages that may perform actions such as credential theft, command interception, API key harvesting, or persistent remote access. The scanner currently protects npm packages, scans more than 100,000 packages daily, and has blocked more than 52,000 packages identified as malware or greyware. ### Source excerpt Chainguard's new scanner blocks malware and 'greyware' before it reaches developers, protecting 100,000+ packages daily across open source ecosystems. ## Shai-Hulud Miasma: Inside the Compromise of Red Hat Packages DevFeed: [Shai-Hulud Miasma: Inside the Compromise of Red Hat Packages]() Original publisher: [Read original article]() Author: Roshan Piyush Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [npm packages](), [Malware](), [Security](), [CI/CD](), [Cloud](), [Encryption](), [Open Source]() Tags: [azure](), [ci-cd](), [encryption](), [gcp](), [malware](), [miasma](), [npm](), [npm-packages](), [security](), [shai-hulud](), [supply-chain]() ### AI overview This article examines the Miasma supply chain attack that compromised official Red Hat npm packages. It describes credential theft, abuse of trusted publishing and CI/CD pipelines, cloud identity enumeration, and per-infection payload encryption, while discussing mitigation. ### Source excerpt An in-depth look at the Miasma supply chain attack that compromised Red Hat npm packages. Learn how the malware spread, stole credentials, abused trusted publishing, and the steps teams can take to mitigate risk. | Blog ## Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp DevFeed: [Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp]() Original publisher: [Read original article]() Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm packages](), [Malware](), [Security](), [CI/CD](), [npm](), [chainguard libraries](), [chainguard]() Tags: [chainguard](), [chainguard-actions](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [malware](), [miasma](), [npm-security](), [packages](), [phantom-gyp](), [shai-hulud](), [supply-chain]() ### AI overview This article describes the Miasma Phantom Gyp npm supply-chain attack, in which attackers published 286 malicious versions across 57 packages. The self-replicating worm targeted CI/CD pipelines, harvested credentials, poisoned additional packages, modified workflows, and planted backdoor configurations in AI coding assistant directories. It also explains that Chainguard customers were protected because Chainguard Libraries builds from source and blocked the malicious versions. ### Source excerpt A new npm supply chain worm compromised 57 packages and 286 versions. Learn how Chainguard blocked the attack and protected customers by design. ## Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages DevFeed: [Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-06-01T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [redhat](), [incident](), [GitHub](), [OpenID connect (OIDC)](), [API](), [React](), [Cloud]() Tags: [api](), [article](), [awareness](), [ci-cd](), [cloud-security](), [developer](), [devops](), [devsecops](), [enablement](), [github](), [incident](), [interest](), [npm-packages](), [oidc](), [payload](), [react](), [redhat](), [sbom](), [scm](), [scope](), [secrets](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview The Miasma supply chain attack compromised at least 32 @redhat-cloud-services npm package releases used by the Red Hat Hybrid Cloud Console. The malicious installation script steals developer and cloud credentials, attempts to spread through packages victims can publish, and may expose secrets on affected workstations and CI runners. ### Source excerpt A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish other packages. ## Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads DevFeed: [Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads]() Original publisher: [Read original article]() Published: 2026-06-01T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Security](), [GitHub Actions](), [npm packages](), [GitHub](), [obfuscation](), [payload](), [OpenID connect (OIDC)]() Tags: [chainguard-actions](), [chainguard-libraries](), [endpoint-security](), [github](), [github-actions](), [malware](), [mini-shai-hulud](), [npm](), [obfuscation](), [oidc](), [packages](), [payload](), [red-hat](), [redhat-cloud-services](), [security](), [shai-hulud](), [tokens]() ### AI overview The article reports that the Mini Shai-Hulud worm compromised more than 90 @redhat-cloud-services npm packages through a hijacked GitHub account and GitHub Actions OIDC trusted publishing. The worm spreads tampered packages and malicious workflows, executes an obfuscated payload during installation, and steals cloud, Vault, GitHub, npm, and CI credentials. Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions were unaffected. ### Source excerpt A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows. ## Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026) DevFeed: [Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026)]() Original publisher: [Read original article]() Published: 2026-05-19T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [npm packages](), [supply-chain-security](), [Malware](), [Data visualization](), [Aeternum](), [stripe](), [Raycast extension](), [React UI animations]() Tags: [2026](), [antv](), [chainguard-libraries](), [chainguard-npm](), [malware](), [mini-shai-hulud](), [npm](), [npm-malware](), [npm-packages](), [react](), [supply-chain](), [supply-chain-security]() ### AI overview The article reports that a compromised npm maintainer account pushed malicious versions of 314 packages in Alibaba's AntV ecosystem on May 19, 2026. It describes the Mini Shai-Hulud campaign, which uses install hooks and obfuscated Bun scripts to deliver malware and harvest developer credentials. ### Source excerpt The Mini Shai-Hulud npm worm compromised 314 packages in the AntV ecosystem on May 19, 2026 -- including echarts-for-react and timeago.js. ## Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account DevFeed: [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-05-18T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Data visualization](), [npm packages](), [Malware](), [npm](), [C2](), [Bun](), [JavaScript](), [GitHub]() Tags: [awareness](), [blog](), [c2](), [data-visualization](), [developer](), [devops](), [devrel](), [javascript](), [malware](), [npm-packages](), [payload](), [secrets](), [security](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security](), [teampcp](), [tokens]() ### AI overview This article analyzes the Mini Shai-Hulud supply-chain attack targeting the AntV data visualization ecosystem through a compromised npm maintainer account. It describes the mass publication of malicious package versions, the embedded Bun payload, credential and secret theft, C2 persistence, and self-propagation using stolen npm tokens. ### Source excerpt A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond. ## Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads DevFeed: [Chainguard artifacts safe from npm supply chain attack targeting SAP developer dependencies with 2.25M+ monthly downloads]() Original publisher: [Read original article]() Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [npm](), [npm packages](), [chainguard](), [GitHub](), [container images](), [Bun](), [Node.js]() Tags: [bun](), [chainguard-containers](), [chainguard-libraries](), [github](), [malicious-packages](), [mini-shai-hulud](), [node-js](), [npm](), [npm-malware](), [npm-worm](), [sap](), [security](), [shai-hulud](), [supply-chain](), [tokens]() ### AI overview A Shai-Hulud-style npm supply-chain attack compromised four SAP Cloud Application Programming Model dependencies with more than 2.25 million combined monthly downloads. The malicious packages used a preinstall hook to download Bun and harvest GitHub tokens, npm tokens, and other developer secrets. Chainguard customers were protected because Chainguard Libraries for JavaScript does not build or serve packages containing install-time scripts, and Chainguard Factory terminated rebuilds when it detected the hook. ### Source excerpt New npm worm targets 2.25M-download packages. Chainguard customers stayed protected by blocking install-time scripts and malicious dependencies. ## The case for dependency cooldowns in a post-axios world DevFeed: [The case for dependency cooldowns in a post-axios world]() Original publisher: [Read original article]() Author: Kennedy Toomey Published: 2026-04-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Application Security](), [npm packages](), [npm](), [JavaScript](), [Malware](), [DevSecOps](), [Vulnerabilities](), [GitHub Actions](), [Python](), [Docker]() Tags: [application-security](), [docker](), [github-actions](), [javascript](), [npm-packages](), [python](), [security](), [supply-chain](), [vulnerabilities]() ### AI overview The article examines how rapidly updating software dependencies can expose organizations to malicious packages and broader software supply chain attacks. It focuses on npm and JavaScript ecosystems while also describing compromises involving GitHub Actions, Python packages, and Docker images. ### Source excerpt Understanding npm and the importance of dependency cooldowns. ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## Phishing Campaign Leveraging the NPM Ecosystem DevFeed: [Phishing Campaign Leveraging the NPM Ecosystem]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-10-09T23:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [npm packages](), [browser](), [Malware](), [Open Source]() Tags: [awareness](), [blog](), [browser](), [cdn](), [developer](), [devrel](), [malicious-packages](), [malware](), [npm](), [npm-packages](), [phishing](), [security](), [snyk](), [snyk-platform](), [supply-chain](), [supply-chain-security]() ### AI overview A phishing campaign abuses the npm ecosystem and the unpkg CDN to host and deliver JavaScript through crafted HTML business documents. More than 175 disposable packages redirect victims to credential-harvesting sites when opened in a browser, targeting over 135 organizations. ### Source excerpt A new phishing campaign weaponizes NPM and the unpkg CDN. Over 175 throwaway packages are used to host scripts that redirect users to credential-harvesting sites. The attack targets enterprise employees through the browser, not developers at install time. ## Mitigating malware in the npm ecosystem with Chainguard Libraries DevFeed: [Mitigating malware in the npm ecosystem with Chainguard Libraries]() Original publisher: [Read original article]() Published: 2025-10-02T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [Malware](), [npm packages](), [npm](), [Security](), [GitHub](), [Open Source]() Tags: [chainguard](), [chainguard-ecosystem](), [chainguard-libraries](), [chainguard-libraries-for-javascript](), [javascript](), [malicious-packages](), [malware](), [npm](), [npm-malware](), [npm-package-attack](), [npm-packages](), [open-source](), [security](), [software-supply-chain]() ### AI overview The article presents research on using Chainguard Libraries for JavaScript to mitigate malware in the npm ecosystem. By requiring attributable source code and validating source-to-artifact integrity through a build-from-source pipeline, the study found that approximately 99% of 8,783 known malicious npm packages would have been prevented from publication, while approximately 99.7% were blocked for users relying on Chainguard Libraries as their sole source of npm dependencies. ### Source excerpt In a recent analysis, Chainguard Libraries for JavaScript prevented over 99% of malicious npm packages published to the npm registry. ## Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source DevFeed: [Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source]() Original publisher: [Read original article]() Published: 2025-09-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [JavaScript](), [Malware](), [npm packages](), [npm]() Tags: [attacks](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-javascript](), [javacript](), [javascript](), [language-library-security](), [malware](), [npm](), [npm-packages](), [package-compromise](), [provenance](), [shai-hulud](), [slsa]() ### AI overview Chainguard announces Chainguard Libraries for JavaScript, a source of trusted language-dependency builds intended to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. The libraries are built from source on hardened SLSA L2 infrastructure, include provenance, and are designed to fit existing developer workflows. ### Source excerpt Chainguard Libraries for JavaScript is designed to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. ## Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack DevFeed: [Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Brian Clark Published: 2025-09-15T11:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [Cybersecurity](), [Angular](), [Bootstrap](), [GitHub Actions](), [API keys](), [GitHub](), [incident](), [Security](), [data](), [Front end]() Tags: [2025](), [angular](), [api-keys](), [awareness](), [blog](), [cybersecurity](), [developer](), [devrel](), [github](), [github-actions](), [incident](), [malware](), [npm](), [package-compromise](), [secrets](), [security](), [shai-hulud](), [supply-chain](), [supply-chain-security](), [worm]() ### AI overview This article reports the Shai-Hulud supply chain attack, in which malicious versions of ngx-bootstrap and other npm packages embedded malware to harvest developer tokens, cloud credentials, API keys, and other secrets. The malware exfiltrated data through webhooks and public GitHub repositories, targeted CI/CD environments through GitHub Actions, and spread across hundreds of compromised packages. The article recommends treating affected systems as compromised, removing the packages, rotating secrets from a trusted machine, and investigating for lateral movement. ### Source excerpt A supply chain attack hit the ngx-bootstrap npm package, embedding malware to steal developer credentials. See affected versions (e.g., 20.0.4-6, 19.0.3) and our playbook to contain the threat and rotate compromised secrets. ## Snyk Security Labs Testing Update: Cursor.com AI Code Editor DevFeed: [Snyk Security Labs Testing Update: Cursor.com AI Code Editor]() Original publisher: [Read original article]() Author: Danny Allan Published: 2025-01-14T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [cursor](), [Security](), [Artificial Intelligence](), [Extension](), [npm](), [npm packages](), [Vulnerabilities](), [Visual Studio Code]() Tags: [ai](), [awareness](), [blog](), [community](), [dependency](), [executive](), [extensions](), [interest](), [no-vulnerabilities](), [npm-packages](), [open-source-security](), [security](), [security-labs](), [snyk](), [vulnerabilities]() ### AI overview Snyk Security Labs investigated Cursor's AI Code Editor for a possible dependency confusion vulnerability involving bundled VSCode extensions and NPM packages. The research found no indications that Cursor was vulnerable to dependency confusion. ### Source excerpt Snyk Security Labs found no indications that Cursor was in any way vulnerable to dependency confusion. ## Edge Functions are now 2x smaller and boot 3x faster DevFeed: [Edge Functions are now 2x smaller and boot 3x faster]() Original publisher: [Read original article]() Author: Nyannyacha Published: 2024-09-12T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [Deno](), [JavaScript](), [npm packages](), [Command-line interface]() Tags: [boot](), [cli](), [dependencies](), [javascript](), [npm](), [npm-packages](), [time]() ### AI overview Supabase reports that Edge Functions are now significantly smaller and faster to boot, especially when they use npm modules. Users can access the improvements by redeploying with Supabase CLI v1.192.5 or later. The article explains that lazy dependency evaluation and deferred integrity checks reduce startup work when functions are bundled with eszip. ### Source excerpt Redeploy your Edge Functions with the CLI v1.192.5 for a peformance boost ## Announcing New Keycloak UI Component Libraries! DevFeed: [Announcing New Keycloak UI Component Libraries!]() Original publisher: [Read original article]() Author: Erik Jan de Wit Published: 2024-09-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [React](), [React Component](), [releases](), [npm packages](), [Development]() Tags: [design-system](), [development](), [idm](), [kerberos](), [keycloak](), [ldap](), [libraries](), [npm](), [openid-connect](), [react](), [react-component](), [release](), [saml](), [sso]() ### AI overview Keycloak announces new React component libraries built on PatternFly for creating account and admin consoles. The article also introduces the npm create keycloak-theme quickstart tool, which currently supports account consoles and is planned to support admin consoles in release 26.0.0. ### Source excerpt We're excited to announce the release of two new npm packages designed to supercharge your Keycloak customization efforts. These React component libraries, built on top of PatternFly, provide the essential building blocks for crafting Keycloak account and admin consoles. The tool generates sample code for a custom console using our "Composable UI" technique. Essentially, this means that you can build your console out of exported Keycloak components that we intend to support in future releases. The packages are: @keycloak/keycloak-admin-ui This package provides the building blocks for creating a Keycloak admin console. @keycloak/keycloak-account-ui This package provides the building blocks for creating a Keycloak account console. @keycloak/ui-shared This package provides shared components and utilities for building Keycloak UIs. Accelerate Your Development with Our Quickstart Tool Kickstart your project with our npm create keycloak-theme my-theme command. This streamlined tool generates a project structure, essential dependencies, and configuration, saving you precious time. At the moment, the tool is only available for account consoles, but we are working on adding support for admin consoles. This will be available in the next release (26.0.0). Get Started: Run npm create keycloak-theme@latest my-theme. The keycloak server can be started with npm run start-keycloak Start the development server with npm run dev Customize your theme by editing files in the src directory. The keycloak server will connect to the development server and all the changes will be reflected in the browser. Just open your browser and go to http://localhost:8080/realms/master/account/personalInfo and login with admin/admin. This will open the keycloak account console. You will see that the example code has an extra page and some extra content above each page. Key Benefits: Rapid development: Create stunning UIs in less time. Consistency: Adhere to the PatternFly design system for a cohesive loo ## Versioning and Releasing Packages in a Monorepo DevFeed: [Versioning and Releasing Packages in a Monorepo]() Original publisher: [Read original article]() Author: Juri Strumpflohner Published: 2024-02-09T00:00:00Z Content type: tutorial Language: en Sources: [Juri Strumpflohner]() Topics: [monorepo](), [npm packages](), [releases](), [Git](), [npm]() Tags: [automated](), [changelog](), [git](), [monorepo](), [npm](), [nx](), [nx-cloud](), [packages](), [pnpm](), [release](), [releases](), [versioning]() ### AI overview A tutorial on using Nx Release to version and publish packages in a monorepo. It covers conventional commits, automated changelog generation, dry runs, package and lockfile updates, Git staging, commits, and tags. ### Source excerpt Learn how to use Nx Release to version and publish packages in your monorepo with conventional commits and automated changelog generation. ## A Journey from Monolith to Micro frontends at Udemy -- Part 3 of 3 DevFeed: [A Journey from Monolith to Micro frontends at Udemy -- Part 3 of 3]() Original publisher: [Read original article]() Author: Hamza ERBAY Published: 2024-01-16T18:23:06Z Content type: article Language: en Sources: [Udemy Engineering]() Topics: [Front end](), [migration](), [Design system](), [GitHub Actions](), [Monitoring](), [npm packages](), [Hackathon]() Tags: [architecture](), [design-system](), [development](), [development-process](), [frontend](), [github-actions](), [micro-frontends](), [migration](), [monitoring](), [npm-packages](), [overcoming-obstacles](), [performance-metrics]() ### AI overview Part 3 of Udemy's series describes implementing a migration from a monolithic frontend to a more modular micro-frontend architecture. It covers migration guidance, shared design-system npm packages, team education, monitoring with Datadog and Sentry, simplified local development, and GitHub Actions-based releases. ### Source excerpt Transforming Frontend Architecture: A Journey from Monolith to Micro Frontends at Udemy -- Part 3 of 3 By: Chris Nienhuis, Hamza Erbay, Matthew Bise, Nathan Chapman, Seth Hodgson, Trey Briggs, Charles Pham Photo by Venti Views on UnsplashIntroduction In the previous section, we walked through the Udemy Hackathon event, and the decisions and preparations made that laid the foundation for our move toward a more modular frontend architecture. In this section, we will focus on the implementation of our vision post-Hackathon, how we are planning to execute the migration, and the impact it has had so far. If you missed Part 1 and Part 2 of this series, you can find them here: Transforming frontend Architecture: A Journey from Monolith to Micro frontends at Udemy -- Part 1... Transforming frontend Architecture: A Journey from Monolith to Micro frontends at Udemy -- Part 2... Post-Hackathon: Implementing the Vision Following the green light from the Shark Tank jury, we've taken decisive steps to translate our hackathon prototype into a scalable and robust frontend architecture. A dedicated frontend team has been formed at Udemy with the express purpose of driving this evolution. "Where the journey began... A throwback to the spark that ignited our incredible voyage. Thanks to Gregg (our former CEO) for recognizing the hard work! #Milestone #Hackathon #OriginStory" Our commitment to this new direction is reflected in a series of strategic actions: Migration Guidance: We've laid out clear guidelines for transitioning (transitioning implies migration) from the monolithic application, ensuring a smooth and structured shift to the new architecture. Collaboration with Design Systems: By partnering with the design system team, we've begun decoupling foundational components and design tokens, packaging them into shared npm packages. This initiative is critical for consistency and efficiency across all applications. Education and Alignment: Recognizing the importance of knowledge sharing, we ## Managing React Form State Using the React-Form Library DevFeed: [Managing React Form State Using the React-Form Library]() Original publisher: [Read original article]() Author: Joe Keohan Published: 2022-09-14T16:30:05Z Content type: tutorial Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [React](), [Forms](), [npm packages](), [Shopify](), [Open Source](), [API]() Tags: [api](), [forms](), [npm](), [npm-packages](), [open-source](), [react](), [shopify](), [tutorial]() ### AI overview This tutorial explains how to manage React form state with Shopify's open source react-form library from the Quilt repository. It introduces the useForm and useField hooks, which manage form and input-field state and validation, provide smart defaults, and reduce the need for manual useState logic and event handlers. ### Source excerpt We'll delve further into Shopify's open source Quilt repo that contains 72 npm packages, one of which is the react-form library. [Next page]()