
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@sentry/react
Advanced tools
This package is a wrapper around @sentry/browser, with added functionality related to React. All methods available in
@sentry/browser can be imported from @sentry/react.
To use this SDK, call Sentry.init(options) before you mount your React component.
import React from 'react';
import { createRoot } from 'react-dom/client';
import * as Sentry from '@sentry/react';
Sentry.init({
dsn: '__DSN__',
// ...
});
// ...
const container = document.getElementById(“app”);
const root = createRoot(container);
root.render(<App />);
// also works with hydrateRoot
// const domNode = document.getElementById('root');
// const root = hydrateRoot(domNode, reactNode);
// root.render(<App />);
Starting with React 19, the createRoot and hydrateRoot methods expose error hooks that can be used to capture errors
automatically. Use the Sentry.reactErrorHandler function to capture errors in the error hooks you are interested in.
const container = document.getElementById(“app”);
const root = createRoot(container, {
// Callback called when an error is thrown and not caught by an Error Boundary.
onUncaughtError: Sentry.reactErrorHandler((error, errorInfo) => {
console.warn('Uncaught error', error, errorInfo.componentStack);
}),
// Callback called when React catches an error in an Error Boundary.
onCaughtError: Sentry.reactErrorHandler(),
// Callback called when React automatically recovers from errors.
onRecoverableError: Sentry.reactErrorHandler(),
});
root.render(<App />);
If you want more finely grained control over error handling, we recommend only adding the onUncaughtError and
onRecoverableError hooks and using an ErrorBoundary component instead of the onCaughtError hook.
@sentry/react exports an ErrorBoundary component that will automatically send Javascript errors from inside a
component tree to Sentry, and set a fallback UI.
app.js
import React from 'react';
import * as Sentry from '@sentry/react';
function FallbackComponent() {
return <div>An error has occurred</div>;
}
class App extends React.Component {
render() {
return (
<Sentry.ErrorBoundary fallback={FallbackComponent} showDialog>
<OtherComponents />
</Sentry.ErrorBoundary>
);
}
}
export default App;
@sentry/react exports a Profiler component that leverages the tracing features to add React-related spans to
transactions. If tracing is not enabled, the Profiler component will not work. The Profiler tracks component mount,
render duration and updates.
app.js
import React from 'react';
import * as Sentry from '@sentry/react';
class App extends React.Component {
render() {
return (
<FancyComponent>
<InsideComponent someProp={2} />
<AnotherComponent />
</FancyComponent>
);
}
}
export default Sentry.withProfiler(App);
LogRocket is a frontend application monitoring solution that provides session replay, performance monitoring, and error tracking. While it offers similar error tracking capabilities to @sentry/react, LogRocket distinguishes itself with its session replay feature, allowing developers to see exactly what users saw when an error occurred.
Bugsnag offers error monitoring and application stability management for various programming languages and frameworks, including React. Compared to @sentry/react, Bugsnag emphasizes application stability metrics and provides detailed error grouping and analysis, making it easier to prioritize and fix critical errors.
FAQs
Official Sentry SDK for React.js
The npm package @sentry/react receives a total of 4,015,506 weekly downloads. As such, @sentry/react popularity was classified as popular.
We found that @sentry/react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.