
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@prefab-cloud/prefab-cloud-react
Advanced tools
A React provider and hook for Prefab
npm install @prefab-cloud/prefab-cloud-react or yarn add @prefab-cloud/prefab-cloud-react
TypeScript types are included with the package.
Wrap your component tree in the PrefabProvider, e.g.
import { PrefabProvider } from "@prefab-cloud/prefab-cloud-react";
const WrappedApp = () => {
const context = {
user: { email: "jeffrey@example.com" },
subscription: { plan: "advanced" },
};
const onError = (error) => {
console.error(error);
};
return (
<PrefabProvider apiKey={"YOUR_API_KEY"} contextAttributes={context} onError={onError}>
<App />
</PrefabProvider>
);
};
Here's an explanation of each provider prop:
| property | required | type | purpose |
|---|---|---|---|
apiKey | yes | string | your Prefab API key |
onError | no | (error) => void | callback invoked if prefab fails to initialize |
contextAttributes | no | ContextAttributes | this is the context attributes object you passed when setting up the provider |
endpoints | no | string[] | CDN endpoints to load configuration from (defaults to 2 prefab-based CDNs) |
timeout | no | number | initialization timeout (defaults to 10 seconds) |
pollInterval | no | number | configures prefab to poll for updates every pollInterval ms. |
Use the usePrefab hook to fetch flags and config values:
const Logo = () => {
const { isEnabled } = usePrefab();
if (isEnabled("new-logo")) {
return <img src={newLogo} className="App-logo" alt="logo" />;
}
return <img src={logo} className="App-logo" alt="logo" />;
};
usePrefab exposes the following:
const { isEnabled, get, loading, contextAttributes } = usePrefab();
Here's an explanation of each property:
| property | example | purpose |
|---|---|---|
isEnabled | isEnabled("new-logo") | returns a boolean (default false) if a feature is enabled based on the current context |
get | get('retry-count') | returns the value of a flag or config |
loading | if (loading) { ... } | a boolean indicating whether prefab content is being loaded |
contextAttributes | N/A | this is the context attributes object you passed when setting up the provider |
prefab | N/A | the underlying JavaScript prefab instance |
keys | N/A | an array of all the flag and config names in the current configuration |
Wrap the component under test in a PrefabTestProvider and provide a config object to set up your
test state.
e.g. if you wanted to test the following trivial component
function MyComponent() {
const { get, isEnabled, loading } = usePrefab();
const greeting = get("greeting") || "Greetings";
if (loading) {
return <div>Loading...</div>;
}
return (
<div>
<h1 role="alert">{greeting}</h1>
{isEnabled("secretFeature") && (
<button type="submit" title="secret-feature">
Secret feature
</button>
)}
</div>
);
}
You could do the following in jest/rtl
import { PrefabTestProvider } from '@prefab-cloud/prefab-cloud-react';
const renderInTestProvider = (config: {[key: string]: any}) => {
render(
<PrefabTestProvider config={config}>
<MyComponent />
</PrefabTestProvider>,
);
};
it('shows a custom greeting', async () => {
renderInTestProvider({ greeting: 'Hello' });
const alert = screen.queryByRole('alert');
expect(alert).toHaveTextContent('Hello');
});
it('shows the secret feature when it is enabled', async () => {
renderInTestProvider({ secretFeature: true });
const secretFeature = screen.queryByTitle('secret-feature');
expect(secretFeature).toBeInTheDocument();
});
Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated. For detailed contributing guidelines, please see CONTRIBUTING.md
This package includes scripts to simplify the release process:
To publish a new standard release (patch version):
./publish-release.sh
This script:
latest tagTo publish a pre-release version:
npm install to update the lockfile./publish-prerelease.sh
This script:
pre tagTo install the pre-release version:
npm install @prefab-cloud/prefab-cloud-react@pre
FAQs
Feature Flags & Dynamic Configuration as a Service
The npm package @prefab-cloud/prefab-cloud-react receives a total of 214 weekly downloads. As such, @prefab-cloud/prefab-cloud-react popularity was classified as not popular.
We found that @prefab-cloud/prefab-cloud-react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.