Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@open-formulieren/sdk
Advanced tools
[![NPM package](https://img.shields.io/npm/v/@open-formulieren/sdk.svg)](https://www.npmjs.com/package/@open-formulieren/sdk) [![Coverage](https://codecov.io/github/open-formulieren/open-forms-sdk/branch/main/graphs/badge.svg?branch=main)](https://codecov
The Open Forms SDK is the frontend to the Open Forms backend. We publish it as both an NPM library of components and pre-built Docker image.
The documentation is available online. Note that the SDK documentation is currently lacking. We're planning to publish Storybook documentation soon.
The target audience for this library is developers who want to compose their own version of the SDK without forking the repository.
Open Forms is developed as a white-label application, including the SDK. While the UI components are fairly generic, there are more organization/theme-specific layouts possible, requiring significant markup changes.
Rather than exposing and maintaining complex options for UI-component customization, we decided to publish the SDK as a library so that (experienced) developers can replace components as they need.
The package exports two ways to use the library:
The former approach allows more fine-grained control and should exclude code/dependencies that aren't used and result in smaller builds, while the latter gives you the public API as it would be available in the browser.
Given the target audience, we expect developers to use option 1.
The underlying React components are published and can serve as a basis for your own components, or even completely replace them (TODO - this is on the roadmap!).
E.g. to re-use the card component:
import Card from '@openformulieren/sdk/components/Card';
const MyCard = props => <Card titleComponent="h2" {...props} />;
export default MyCard;
NOTE: the published components are semi-private API. We cannot provide guarantees that it will be 100% backwards-compatible. If we know breaking changes are made, we will bump the major version number, but you should probably do extensive testing even with minor versions.
Exposed API
The package.json
describes the module exports, at the time of writing these are:
@openformulieren/sdk/components/*
@openformulieren/sdk/hooks/*
@openformulieren/sdk/types/*
@openformulieren/sdk/map/*
@openformulieren/sdk/sdk
@openformulieren/sdk/utils
These will be documented with Storybook at some point.
If you decide that using the SDK itself is sufficient, then your usage comes down to:
import OpenForm, {
ANALYTICS_PROVIDERS,
Formio,
OFLibrary,
OpenFormsModule,
Templates,
setCSRFToken,
} from '@open-formulieren/sdk';
// JS API
import '@open-formulieren/sdk/styles.css';
// import the (default) stylesheet
const form = new OpenForm(targetNode, options);
form.init();
FAQs
[![NPM package](https://img.shields.io/npm/v/@open-formulieren/sdk.svg)](https://www.npmjs.com/package/@open-formulieren/sdk) [![Coverage](https://codecov.io/github/open-formulieren/open-forms-sdk/branch/main/graphs/badge.svg?branch=main)](https://codecov
The npm package @open-formulieren/sdk receives a total of 32 weekly downloads. As such, @open-formulieren/sdk popularity was classified as not popular.
We found that @open-formulieren/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.