
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@slithy/layers
Advanced tools
Layer and z-index management for React UIs. Tracks a stack of mounted layers and determines which is "active" (highest priority). Useful for managing focus, keyboard interactions, and visual stacking of overlaid components like modals and drawers.
npm install @slithy/layers
Peer dependencies: react@^17 || ^18 || ^19
LayerProviderWraps a component to register it in the global layer stack. On mount, the layer is added to the stack; on unmount, it is removed.
import { LayerProvider, LayerStackPriority } from '@slithy/layers'
<LayerProvider id="my-modal" zIndex={LayerStackPriority.Modal}>
<MyModal />
</LayerProvider>
Props:
| Prop | Type | Default | Description |
|---|---|---|---|
id | string | auto-generated | Unique identifier for this layer |
zIndex | number | 0 | Priority in the stack — higher wins |
isActive | boolean | true | If false, layer is not registered in the stack |
children | ReactNode | — |
useLayerStateHook to read state from the nearest LayerProvider. Must be called within a LayerProvider.
// Selector form — returns selected value, re-renders only on change
const layerIsActive = useLayerState(s => s.layerIsActive)
// No-arg form — returns full store object
const { getState, setState } = useLayerState()
Store shape (LayerStore):
type LayerStore = {
layerID: string
layerIsActive: boolean // true when this layer has the highest priority
zIndex: number
}
useLayerStackStoreReactive hook for reading the global layer stack store. Call with a selector to get reactive updates whenever the layer stack changes.
import { useLayerStackStore } from '@slithy/layers'
// Selector form — re-renders only when the selected value changes
const activeLayerId = useLayerStackStore(state => state.activeLayerId)
// Full store object — returns current state
const { activeLayerId, layers } = useLayerStackStore(state => state)
For imperative access (outside React components or in effects):
// Read current state
const { activeLayerId, layers } = useLayerStackStore.getState()
// Subscribe to changes
const unsubscribe = useLayerStackStore.subscribe(() => {
const { activeLayerId } = useLayerStackStore.getState()
})
createLayerPrioritiesFactory for defining a custom set of layer priorities. Returns a frozen readonly object.
import { createLayerPriorities } from '@slithy/layers'
const MyPriorities = createLayerPriorities({
App: 0,
Overlay: 5,
Toast: 10,
})
<LayerProvider zIndex={MyPriorities.Toast}>
<ToastStack />
</LayerProvider>
LayerStackPriorityThe built-in default priority set, defined with createLayerPriorities:
const LayerStackPriority = createLayerPriorities({
App: 0,
Modal: 1,
Toasts: 2,
})
MockLayerProviderA test utility that provides a mock layer context with hardcoded values. Use this to render components that depend on LayerProvider without needing a real stack.
import { MockLayerProvider } from '@slithy/layers'
render(
<MockLayerProvider>
<ComponentUnderTest />
</MockLayerProvider>
)
FAQs
Layer and z-index management for React UIs.
We found that @slithy/layers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.