Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@shopify/ui-extensions
Advanced tools
This package contains the public type definitions and utilities needed to create a Shopify UI extension. This is a generalized package that is intended to be the long-term home of the surface-specific packages in this repository, like `@shopify/checkout-u
@shopify/ui-extensions
This package contains the public type definitions and utilities needed to create a Shopify UI extension. This is a generalized package that is intended to be the long-term home of the surface-specific packages in this repository, like @shopify/checkout-ui-extensions
and @shopify/admin-ui-extensions
.
Currently, this package contains the API for two surfaces:
This surface-based grouping is mostly cosmetic; all extensions use the same underlying technology, and most of the same “core” components (e.g., Layout
, BlockStack
, etc) and capabilities (e.g., direct API access, session tokens). Separating APIs by surface makes it easier for a developer to see what is available to them in each context, and gives us a flexible system for introducing components and APIs available in only some surfaces.
An admin extension using “vanilla” JavaScript would be written as follows:
import {
extension,
TextField,
EditorSettings,
} from '@shopify/ui-extensions/admin';
export default extension(
'Admin::CheckoutEditor::RenderSettings',
(root, {settings, applySettingChange}) => {
const editorSettings = root.createComponent(EditorSettings);
const textfield = root.createComponent(TextField, {
label: 'Message',
helpText: 'The message to show to buyers when this extension is rendered',
value: settings.current.message,
onChange(value) {
applySettingsChange({key: 'message', value});
},
});
editorSettings.appendChild(textfield);
root.appendChild(editorSettings);
},
);
A UI extension is a JavaScript-based module that can hook in to client-side behaviors on any of Shopify’s first party UI surface areas. No matter whether the developer is embedding into the admin or checkout, whether they are rendering UI or registering listeners for client-side events; it’s all a UI extension.
The most minimal definition of a UI extension has the following properties:
Checkout::CartLines::RenderAfter
gives the UI Extension the ability to render UI after the cart lines in a checkout; WebPixel::Register
registers a Web Pixel to track client-side events. A UI Extension can register to support multiple extension points, and must map each to a JavaScript module in their application.The types in this package allow us to represent additional details about the extension points developers can implement. Each extension point can define what APIs it supports, including:
The available components and APIs can be different for each extension point. Additionally, Shopify can vary the components and APIs it provides based on many other factors at runtime, like:
FAQs
This package contains the public type definitions and utilities needed to create a Shopify UI extension. This is a generalized package that is intended to be the long-term home of the surface-specific UI extension packages, like [`@shopify/checkout-ui-ext
The npm package @shopify/ui-extensions receives a total of 80,291 weekly downloads. As such, @shopify/ui-extensions popularity was classified as popular.
We found that @shopify/ui-extensions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.