
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@bjoerge/react-popper
Advanced tools
React wrapper around PopperJS.
npm install react-popper --save or yarn add react-popper
<script src="https://unpkg.com/react-popper/dist/react-popper.js"></script>
(UMD library exposed as `ReactPopper`)
import { Manager, Target, Popper, Arrow } from 'react-popper'
const PopperExample = () => (
<Manager>
<Target style={{ width: 120, height: 120, background: '#b4da55' }}>
Target Box
</Target>
<Popper placement="left" className="popper">
Left Content
<Arrow className="popper__arrow"/>
</Popper>
<Popper placement="right" className="popper">
Right Content
<Arrow className="popper__arrow"/>
</Popper>
</Manager>
)
This is a useful way to interact with custom components. Just make sure you pass down the refs properly.
import { Manager, Target, Popper, Arrow } from 'react-popper'
const PopperExample = () => (
<Manager>
<Target>
{({ targetProps }) => (
<div {...targetProps}>
Target Box
</div>
)}
</Target>
<Popper placement="left">
{({ popperProps, restProps }) => (
<div
className="popper"
{...popperProps}
>
Popper Content
<Arrow>
{({ arrowProps, restProps }) => (
<span
className="popper__arrow"
{...arrowProps}
/>
)}
</Arrow>
</div>
)}
</Popper>
</Manager>
)
It's generally easiest to let the Manager and Target components handle passing the target DOM element to the Popper component. However, you can pass a target Element or a referenceObject directly into Popper if you need to.
Handling DOM Elements from React can be complicated. The Manager and Target components handle these complexities for you, so their use is strongly recommended when using DOM Elements.
import { PureComonent } from 'react'
import { Popper, Arrow } from 'react-popper'
class StandaloneExample extends PureComponent {
state = {
isOpen: false,
}
handleClick() = () => {
this.setState(prevState => ({
isOpen: !prevState.isOpen
}))
}
render() {
return (
<div>
<div
ref={(div) => this.target = div}
style={{ width: 120, height: 120, background: '#b4da55' }}
onClick={this.handleClick}
>
Click {this.state.isOpen ? 'to hide' : 'to show'} popper
</div>
{this.state.isOpen && (
<Popper className="popper" target={this.target}>
Popper Content
<Arrow className="popper__arrow"/>
</Popper>
)}
</div>
)
}
}
Shared PropsTarget, Popper, and Arrow all share the following props
component: PropTypes.oneOfType([PropTypes.node, PropTypes.func])A valid DOM tag or custom component to render. If using a custom component, an innerRef prop will be passed down that must be attached to the child component ref.
innerRef: PropTypes.funcUse this prop to access the internal ref. Does not apply to the Manager component since we do not interact with its ref.
ManagerThis is a special component that provides the Target component to the Popper component. Pass any props as you normally would here.
tag: PropTypes.oneOfType([PropTypes.string, PropTypes.bool])A valid DOM tag to render. Allows rendering just children by passing false. Once React 16 is out, this prop will most likely go away since we will be able to return an array and all this currently does is subscribe Target and Popper.
TargetThis is just a simple component that subscribes to PopperManager, so Popper can make use of it. Again, pass any props as you normally would here.
Each Target must be wrapped in a Manager, and each Manager can wrap only one Target.
children: PropTypes.oneOfType([PropTypes.node, PropTypes.func])A Target's child may be one of the following:
a React element[s]
a function accepting the following object (all props must be passed down in order for the PopperJS to work properly)
{
targetProps: {
ref, // a function that accepts the target component as an argument
},
restProps, // any other props that came through the Target component
}
PopperYour popper that gets attached to the Target component.
Each Popper must either be wrapped in a Manager, or passed a target prop directly. Each Manager can wrap multiple Popper components.
placement: PropTypes.oneOf(Popper.placements)eventsEnabled: PropTypes.boolmodifiers: PropTypes.objecttarget: PropTypes.oneOfType([PropTypes.instanceOf(Element), Popper.referenceObject])Passes respective options to a new Popper instance. As for onCreate and onUpdate, these callbacks were intentionally left out in favor of using the component lifecycle methods. If you have a good use case for these please feel free to file and issue and I will consider adding them in.
children: PropTypes.oneOfType([PropTypes.node, PropTypes.func])A Popper's child may be one of the following:
a React element[s]
a function accepting the following object (all props must be passed down in order for the PopperJS to work properly)
{
popperProps: {
ref, // a function that accepts the popper component as an argument
style, // the styles to apply to the popper element
'data-placement', // the placement of the Popper
},
restProps, // any other props that came through the Popper component
}
ArrowAnother component that subscribes to the Popper component as an arrow modifier. Must be a child of Popper.
children: PropTypes.oneOfType([PropTypes.node, PropTypes.func])An Arrow's child may be one of the following:
a React element[s]
a function accepting the following object (all props must be passed down in order for the PopperJS to work properly)
{
arrowProps: {
ref, // a function that accepts the arrow component as an argument
style, // the styles to apply to the arrow element
},
restProps, // any other props that came through the Arrow component
}
git clone git@github.com:souporserious/react-popper.git
cd ~/react-popper
npm install or yarn
npm run dev or yarn dev
http://localhost:8080/
FAQs
React wrapper around PopperJS.
The npm package @bjoerge/react-popper receives a total of 4 weekly downloads. As such, @bjoerge/react-popper popularity was classified as not popular.
We found that @bjoerge/react-popper demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.