
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@nectary/cli
Advanced tools
Add Nectary compositions (higher-order React components built on @nectary/components) directly into your project. This follows the same “copy source into your repo” approach as Shadcn UI, so you own the code and can edit it. It is aimed at React 16–18 apps where using these compositions as web components would require awkward serialization of objects/arrays.
engines in package.json)@nectary/components installednpx @nectary/cli list
Prints each available composition name and its one-line description.
Preview a composition before adding it (description, dependencies, and files that would be written):
npx @nectary/cli view <name>
Example:
npx @nectary/cli view table
From your project root:
npx @nectary/cli add <name>
Examples:
npx @nectary/cli add button
npx @nectary/cli add select
npx @nectary/cli add phone-input
npx @nectary/cli add table
Files are written under src/components/nectary/ by default (see Configuration). The CLI will also install any npm dependencies required by the composition (e.g. countries-phone-masks for phone-input).
--path <path> – Override the output directory (default: src/components/nectary).--overwrite – Replace existing files. Without this, existing files are skipped.Optional: create a nectary.json file at your project root to set the default components path:
{
"componentsPath": "src/components/nectary"
}
If nectary.json is missing, the CLI uses src/components/nectary.
Compositions live in this package under registry/ and can be customized (e.g. add props) without touching the docs.
| Name | Description | Dependencies |
|---|---|---|
button | Simple Button (sinch-button). Props: text, aria-label, type, size, disabled, toggled, formType, onClick. | — |
select | Select with search. Props: options, placeholder, searchPlaceholder, value, onChange, style, ariaLabel. | — |
phone-input | Phone input with country code selector. Props: placeholder, value, onChange, style, ariaLabel. | countries-phone-masks |
table | Table composition. Props: columns, data, getRowKey. | — |
From the monorepo root or from packages/nectary-cli:
pnpm --filter nectary build
Then from the project where you want to add a composition:
node /path/to/nectary/packages/nectary-cli/dist/index.js add select
Or from packages/nectary-cli:
node dist/index.js add select
registry/<name>/ (e.g. registry/select/Search.tsx). You can add whatever props you want; these files are the single source of truth for the CLI and are independent of the docs.registry.json in this package. Add an item with:
name – Kebab-case id used in nectary add <name>.description – Short description.dependencies – Array of npm package names (e.g. "zod", "@hookform/resolvers").files – Array of { "path": "OutputPath/File.tsx", "source": "registry/<name>/File.tsx" }.path is where the file will be written in the user's project (relative to their components path). source is relative to this package root (e.g. registry/select/Search.tsx).packages/nectary-cli, run pnpm run build (or pnpm run build:registry after tsc). This reads the manifest and writes dist/registry/<name>.json.nectary package so users can run npx @nectary/cli add <name>.FAQs
CLI to add Nectary compositions as React components to your project
The npm package @nectary/cli receives a total of 356 weekly downloads. As such, @nectary/cli popularity was classified as not popular.
We found that @nectary/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.