
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@sahircansurmeli/react-mde
Advanced tools
A simple yet powerful and extensible React Markdown Editor that aims to have feature parity with the Github Markdown editor. React-mde has no 3rd party dependencies.
Added support for toggling commands.
npm i react-mde
React-mde is a completely controlled component.
Minimal example using Showdown. View live on CodeSandBox:
import * as React from "react";
import ReactMde from "react-mde";
import * as Showdown from "showdown";
import "react-mde/lib/styles/css/react-mde-all.css";
const converter = new Showdown.Converter({
tables: true,
simplifiedAutoLink: true,
strikethrough: true,
tasklists: true
});
export default function App() {
const [value, setValue] = React.useState("**Hello world!!!**");
const [selectedTab, setSelectedTab] = React.useState<"write" | "preview">("write");
return (
<div className="container">
<ReactMde
value={value}
onChange={setValue}
selectedTab={selectedTab}
onTabChange={setSelectedTab}
generateMarkdownPreview={markdown =>
Promise.resolve(converter.makeHtml(markdown))
}
/>
</div>
);
}
React-mde is agnostic regarding how to preview Markdown. The prop generateMarkdownPreview should return a Promise of either a string or a ReactElement.
React-mde comes with SVG icons extracted from FontAwesome.
You can customize the way icons are resolved by passing your own getIcon that will return a ReactNode
given a command name.
<ReactMde
getIcon={(commandName) => <MyCustomIcon name={commandName} />}
onChange={this.handleValueChange}
// ...
/>
The types are described below
onChange event.[["code", "bold"], ["italic"]]. The default list can be obtained with import { getDefaultToolbarCommands } from 'react-mde', getDefaultToolbarCommands()prop is falsy, then no preview is going to be generated.iconProvider to allow custom icon rendering.
options. It is recommended to inspect the layouts source code to see what options can be passed to each
while the documentation is not complete.write, preview, uploadingImage and pasteDropSelect.px.text and triggeredBy (character that triggered the suggestions). The result should be an array of {preview: React.ReactNode, value: string}.
The preview is what is going to be displayed in the suggestions box. The value is what is going to be inserted in the textarea on click or enter.loadSuggestions.writeButton, previewButton, commandButtons and textArea.The following styles from React-mde should be added: (Both .scss and .css files are available. No need to use sass-loader if you don't want)
Easiest way: import react-mde-all.css:
import 'react-mde/lib/styles/css/react-mde-all.css';
If you want to have a more granular control over the styles, you can import each individual file.
If you're using SASS, you can override these variables: https://github.com/andrerpena/react-mde/blob/master/src/styles/variables.scss
React-mde does not automatically sanitize the HTML preview. If your using Showdown, this has been taken from their documentation:
Cross-side scripting is a well known technique to gain access to private information of the users of a website. The attacker injects spurious HTML content (a script) on the web page which will read the user’s cookies and do something bad with it (like steal credentials). As a countermeasure, you should filter any suspicious content coming from user input. Showdown doesn’t include an XSS filter, so you must provide your own. But be careful in how you do it…
You might want to take a look at showdown-xss-filter.
It is also possible to return a Promise to a React Element from generateMarkdownPreview, which makes
it possible to use ReactMarkdown as a preview. View issue.
ReactMarkdown has built-in XSS protection.
Please refer to the commands source code to understand how they should be implemented.
React-mde is MIT licensed.
In order to make React-mde zero deps, I've embedded two small libraries:
Made with :heart: by André Pena and other awesome contributors.
Added toggle support by Sahircan Sürmeli
FAQs
React Markdown Editor
We found that @sahircansurmeli/react-mde demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.