
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@malectro/rerouter
Advanced tools
Rerouter is a standalone routing library written for React and similar to react-router.
Rerouter intends to be a router for React Fiber and Suspense.
Historically, routing libraries written for web UI would resolve a set of routes (declarative or procedural) all at once, eventually resulting in a view or set of components. Sometimes this process would involve transitions or async dependencies to determine whether or not a piece of UI could be seen.
Here's how I might describe Express's routing system at its most simplistic. Notice that this system would work in most environments and ignores the existence of React.
async function route(pathname) {
for (const route of routes) {
if (matches(route, pathname)) {
const view = await route.callback();
if (view) {
return view;
}
}
}
}
React 17 officially introduces the concept of prerendering. This means that when state changes, React will start to render the next tree before it replaces the old one. If the next tree indicates an async dependency, React will wait for that resource before it transitions to the next tree. React also allows for aborting the transition -- essentially throwing out the prerendered tree in favor of a new state change.
All of this behavior is very similar to that of a routing library -- to the point where it would seem silly to include code that accomplishes a nearly identical goal. Within a React application, it makes sense for React to handle state management, subscriptions, and rendering.
And using React to handle routing provides a few more unique benefits:
React.lazy.Rerouter takes full advantage of React's state management and subscription systems but still uses the History and Location APIs as a source of truth. In practice, this means a few things:
A Router provider must be rendered near the top of the application tree. This provides subscription access to the location and history anywhere in the application, but it importantly does not care how routing is accomplished – making it a fairly simple component.
A useRoutes hook provides the basis for actual routing. It takes a list of routes and returns a React subtree based on how they match the current location pathname. There are a few important aspects of this:
onEnter and getComponent from RR3 do not exist.)Params are extracted by useRoutes -- not the Router provider. This means that params are only available to children produced by useRoutes. In practice this only affects components like ModalRoot that will never have access to the route tree.useRoutes can be called multiple times by different subtrees, which allows collections of routes to be moved to different subpaths and namespaces at will. It also means we can code split at the route level using React.lazy.Here is some JSX pseudocode that outlines the way a Rerouter application might look.
function App() {
return (
<RerouterProvider>
<AppRoutes />
</RerouterProvider>
);
}
function AppRoutes() {
return useRoutes([
{path: '', exact: true, element: <Dashboard />},
{path: 'posts', element: <PostsRoutes />},
{path: '*', element: <NotFound />},
]);
}
function PostsRoutes() {
const isAdmin = useIsAdmin();
return useRoutes([
{
path: ':postId',
children: [
{path: '', exact: true, element: ({params: {postId}}) => <PostView postId={postId} />},
isAdmin && {path: 'edit', element: ({params: {postId}}) => <PostEdit postId={postId} />},
],
},
]);
}
Notice a few things:
PostRoutes and Dashboard are both components, and the router makes no distinctions. The only difference is that PostRoutes calls useRoutes.PostRoutes handles this at render time. If the user is not an admin, the route effectively does not exist.useRoutes could be "lazy". Rerouter does not care (or really know the difference).FAQs
a thin routing library designed as an easy replacement for react-router
We found that @malectro/rerouter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.