
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@ihalton/components
Advanced tools
npm install --save react@16.4.2 prop-types@15.6.2 styled-components@3.3.3 reacto-form@0.0.2 @reactioncommerce/components-context@1.0.0 @reactioncommerce/components
or
yarn add react@16.4.2 prop-types@15.6.2 styled-components@3.3.3 reacto-form@0.0.2 @reactioncommerce/components-context@1.0.0 @reactioncommerce/components
Note that the minimum required React version is 16.4.1 because this package uses newer APIs like createContext and forwardRef. The react, prop-types, @reactioncommerce/components-context, reacto-form, and styled-components packages are peer dependencies, which means that you must install the proper versions in your app. They are not included with this package.
If you use the
StripeFormcomponent, then you must also installreact-stripe-elements@2.0.1. It is an optional peer dependency.
Then import a component:
import Button from "@reactioncommerce/components/Button/v1";
Notice that you must specify what version of the component you want. If you update to a newer minor or patch release of the @reactioncommerce/components package, none of your components will change by default. You will also have to change where you import them from, for example, change v1 to v2. Occasionally we will release a new major version of the package, and some of the older component versions may disappear.
In your HTML:
// Font for display type
<link href="https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,600,700" rel="stylesheet">
Several components in this library use Font Awesome icons in scalable vector graphic format (SVGs), under the Font Awesome Free License.
FAQs
Reaction Commerce - Example Storefront Component Library
We found that @ihalton/components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.