
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@storybook/codemod
Advanced tools
Storybook Codemods is a collection of codemod scripts written with JSCodeshift. It will help you migrate breaking changes & deprecations.
The preferred way to run these codemods is via the CLI's migrate command.
To get a list of available codemods:
npx sb migrate --list
To run a codemod <name-of-codemod>:
npx sb migrate <name-of-codemod> --glob="**/*.stories.js"
If you want to run these codemods by hand:
yarn add jscodeshift @storybook/codemod --dev
@storybook/codemod is our collection of codemod scripts.jscodeshift is a tool we use to apply our codemods.After running the migration commands, you can remove them from your package.json, if you added them.
From the directory where you installed both jscodeshift and @storybook/codemod run:
Example:
./node_modules/.bin/jscodeshift -t ./node_modules/@storybook/codemod/dist/transforms/upgrade-hierarchy-separators.js . --ignore-pattern "node_modules|dist"
Explanation:
<jscodeShiftCommand> -t <transformFileLocation> <pathToSource> --ignore-pattern "<globPatternToIgnore>"
Starting in 5.3, Storybook is moving to using a single path separator, /, to specify the story hierarchy. It previously defaulted to | for story "roots" (optional) and either / or . for denoting paths. This codemod updates the old default to the new default.
./node_modules/.bin/jscodeshift -t ./node_modules/@storybook/codemod/dist/transforms/upgrade-hierarchy-separators.js . --ignore-pattern "node_modules|dist"
For example:
storiesOf('Foo|Bar/baz');
storiesOf('Foo.Bar.baz');
export default {
  title: 'Foo|Bar/baz.whatever',
};
Becomes:
storiesOf('Foo/Bar/baz');
storiesOf('Foo/Bar/baz');
export default {
  title: 'Foo/Bar/baz/whatever',
};
Starting in 6.0, Storybook has deprecated the .story annotation in CSF and is using hoisted annotations.
./node_modules/.bin/jscodeshift -t ./node_modules/@storybook/codemod/dist/transforms/csf-hoist-story-annotations.js . --ignore-pattern "node_modules|dist" --extensions=js
For example:
export const Basic = () => <Button />
Basic.story = {
  name: 'foo',
  parameters: { ... },
  decorators: [ ... ],
};
Becomes:
export const Basic = () => <Button />
Basic.storyName = 'foo';
Basic.parameters = { ... };
Basic.decorators = [ ... ];
The new syntax is slightly more compact, is more ergonomic, and resembles React's displayName/propTypes/defaultProps annotations.
Learn more about Storybook at storybook.js.org.
jscodeshift is a toolkit for running codemods over multiple JavaScript or TypeScript files. It provides a more general-purpose approach compared to @storybook/codemod, which is specifically tailored for Storybook-related transformations.
react-codemod offers a collection of React-specific transformations to help update React APIs and patterns. While it targets React specifically, unlike @storybook/codemod, it does not focus on Storybook configurations or story formats.
FAQs
A collection of codemod scripts written with JSCodeshift
The npm package @storybook/codemod receives a total of 1,186,016 weekly downloads. As such, @storybook/codemod popularity was classified as popular.
We found that @storybook/codemod demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.