
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@cometchat/cards-react-native
Advanced tools
CometChat Card Schema renderer for React Native — converts Card Schema JSON into native views
A React Native renderer for the CometChat Card Schema. Pass in card JSON, get back a native view tree. Taps on interactive elements are emitted to your app through a single callback — the package never executes actions itself.
auto, light, and dark modes, with optional theme overridesonAction callback as typed CometChatCardActionEventsThe package is a pure renderer. It doesn't talk to the CometChat SDK, doesn't manage message lifecycle, and doesn't know about your app's navigation. You decide what each action does.
npm install @cometchat/cards-react-native
Peer dependencies (must be in your project):
{
"react": ">=18.0.0",
"react-native": ">=0.76.0"
}
import { CometChatCardView } from '@cometchat/cards-react-native';
function CardScreen({ cardJson }: { cardJson: string }) {
return (
<CometChatCardView
cardJson={cardJson}
themeMode="auto"
onAction={(event) => {
// Handle the action — navigate, send a message, open a URL, etc.
console.log(`action: ${event.action.type} from ${event.elementId}`);
}}
/>
);
}
| Prop | Type | Default | Description |
|---|---|---|---|
cardJson | string | — | Card Schema JSON string (required) |
themeMode | 'auto' | 'light' | 'dark' | 'auto' | Theme mode. auto follows the device system theme. |
onAction | (event: CometChatCardActionEvent) => void | — | Callback fired when a user taps an interactive element with a valid action |
onContainerStyle | (style: CometChatCardResolvedContainerStyle) => void | — | Emits the card's resolved container style (background, borderRadius, padding, etc.) for the consumer to apply to a parent wrapper |
themeOverride | CometChatCardThemeOverride | — | Override default theme tokens (colors, typography) |
logLevel | 'none' | 'error' | 'warning' | 'verbose' | 'warning' | Controls internal logging verbosity |
The renderer falls back to a built-in default theme when JSON omits colors. To override defaults, pass a themeOverride:
<CometChatCardView
cardJson={cardJson}
themeMode="dark"
themeOverride={{
textColor: { light: '#141414', dark: '#F5F5F5' },
buttonFilledBg: { light: '#1A73E8', dark: '#8AB4F8' },
}}
/>
Any ColorValue in the schema is resolved to its light or dark variant based on the effective theme mode.
When a user taps a button, iconButton, or link, the package invokes onAction with a CometChatCardActionEvent containing:
action — the full action object (type + all parameters)elementId — id of the tapped elementcardJson — the card JSON the action originated fromSupported action types: openUrl, copyToClipboard, downloadFile, apiCall, chatWithUser, chatWithGroup, sendMessage, initiateCall, customCallback.
If you don't pass onAction, taps are ignored.
The onContainerStyle callback emits the card's root container style with colors already resolved for the current theme mode:
const [bubbleStyle, setBubbleStyle] = useState({});
<View style={bubbleStyle}>
<CometChatCardView
cardJson={cardJson}
themeMode="auto"
onContainerStyle={(style) => setBubbleStyle({
backgroundColor: style.background, // already resolved hex string
borderRadius: style.borderRadius,
borderColor: style.borderColor,
})}
/>
</View>
This is useful when embedding the card inside a message bubble — the bubble wrapper can match the card's visual settings.
The package has no runtime dependencies beyond React and React Native. Image loading uses RN's built-in <Image>, animations use Animated, markdown is parsed with a custom built-in parser, and shimmer placeholders are rendered with native Views.
See the CardRendererDemo/ app for runnable samples and the design documents for the full schema reference.
FAQs
CometChat Card Schema renderer for React Native — converts Card Schema JSON into native views
We found that @cometchat/cards-react-native demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.