
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@beeq/react
Advanced tools
A lightweight utility that wraps BEEQ custom elements ("web components") so they can be used like native React components.
React and custom elements don't play nicely together. The problem is best described by Custom Elements Everywhere:
Handling data
React passes all data to Custom Elements in the form of HTML attributes. For primitive data this is fine, but the system breaks down when passing rich data, like objects or arrays. In these instances you end up with stringified values like some-attr="[object Object]" which can't actually be used.
Handling events
Because React implements its own synthetic event system, it cannot listen for DOM events coming from Custom Elements without the use of a workaround. Developers will need to reference their Custom Elements using a ref and manually attach event listeners with addEventListener. This makes working with Custom Elements cumbersome.
This utility solves these problems by exposing a native React component that maps properties and events to the underlying custom element. ✨
[!TIP] Please always refer to the official BEEQ documentation for more information about the installation.
npm install @beeq/{core,react}
[!NOTE] Make sure that you have installed the
@beeq/corepackage.
Import BEEQ styles into your application's main style file:
@import "@beeq/core/dist/beeq/beeq.css";
[!TIP] BEEQ uses SVG icons and these assets are shipped in a separate folder. You can use the
setBasePathmethod to set the path to the icons. Make sure that your project bundle the icons in a way that they are accessible from the browser.
You can move the icons from the node_modules folder to your assets folder and set the path like this:
// vite.config.js
import { defineConfig } from 'vite';
import { viteStaticCopy } from 'vite-plugin-static-copy';
import react from '@vitejs/plugin-react';
export default defineConfig({
plugins: [
react(),
viteStaticCopy({
targets: [
{
src: './node_modules/@beeq/core/dist/beeq/svg/*',
dest: 'icons/svg',
},
// add more targets if needed
],
}),
],
// other configurations
});
// main.ts
import { setBasePath } from "@beeq/core/dist/components";
setBasePath('icons/svg');
Please, notice the path 👆
But you can also use a different icons library or a CDN:
import { setBasePath } from "@beeq/core/dist/components";
// Using heroicons library
setBasePath('https://cdn.jsdelivr.net/npm/heroicons@2.1.5/24/outline');
[!CAUTION] When using a different icons library, make sure you use the correct icon names provided by the library or the CDN.
import React from 'react';
import { BqButton } from '@beeq/react';
function App() {
const handleButtonClick = (ev: CustomEvent) => {
console.log(ev.detail);
};
return (
<BqButton appearance="primary" onBqClick={handleButtonClick}>
Click Me
</BqButton>
);
}
export default App;
FAQs
React specific wrapper for BEEQ Design System components
We found that @beeq/react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.