
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
coffee-react-transform
Advanced tools
Provides support for an equivalent of JSX syntax in Coffeescript (called CJSX) so you can write your Facebook React components with the full awesomeness of Coffeescript.
car-component.coffee
# @cjsx React.DOM
Car = React.createClass
render: ->
<Vehicle doors={4} locked={isLocked()} data-colour="red" on>
<Parts.FrontSeat />
<Parts.BackSeat />
<p className="seat">Which seat can I take? {@props?.seat or 'none'}</p>
</Vehicle>
transform
cjsx-transform car-component.coffee
output
Car = React.createClass
render: ->
React.createElement(Vehicle, {"doors": (4), "locked": (isLocked()), "data-colour": "red", "on": true},
React.createElement(Parts.FrontSeat, null),
React.createElement(Parts.BackSeat, null),
React.createElement(React.DOM.p, {"className": "seat"}, "Which seat can I take? ", (@props?.seat or 'none'))
)
Note: this example shows the output of the 1.x branch, which supports the
new factoryless creation of descriptors using React.createElement
.
If you want the older style JSX output (which just desugars into function calls)
then you need to use the 0.x branch, eg. 0.5.1
.
The try coffee-react tool is available to test out some CJSX code and see the CoffeeScript it transforms into.
coffee-react-transform
simply handles preprocessing Coffeescript with JSX-style markup into valid Coffeescript. Instead of using it directly, you may want to make use of one of these more high-level tools:
coffee
executable, for compiling CJSX.require
CJSX files on the server (also possible with coffee-react/register).cjsx-transform [input file]
Outputs Coffeescript code to stdout. Redirect it to a file or straight to the Coffeescript compiler, eg.
cjsx-transform examples/car.coffee | coffee -cs > car.js
transform = require 'coffee-react-transform'
transformed = transform('...some CJSX code...')
From npm:
npm install -g coffee-react-transform
If you want to use coffee-react-transform in the browser or under ExecJS or some other environment that doesn't support CommonJS modules, you can use this build provided by BrowserifyCDN, which will work as an AMD module or just a plain old script tag:
http://wzrd.in/standalone/coffee-react-transform
<script src="http://wzrd.in/standalone/coffee-react-transform"></script>
<script>
coffeeReactTransform('-> <a />');
// returns "-> React.createElement(React.DOM.a, null)"
</script>
A recent addition to JSX (and CJSX) is 'spread attributes' which allow merging an object of props into a component, eg:
extraProps = color: 'red', speed: 'fast'
<div color="blue" {... extraProps} />
which is transformed to:
extraProps = color: 'red', speed: 'fast'
React.createElement(React.DOM.div, Object.assign({"color": "blue"}, extraProps)
If you use this syntax in your code, be sure to include a shim for Object.assign
for browsers/environments which don't yet support it (basically none do so far).
es6-shim and object.assign are two possible choices.
React 0.12 will introduce changes to the way component descriptors are constructed, where the return value of React.createClass
is not a descriptor factory but simply the component class itself, and descriptors must be created manually using React.createElement
or by wrapping the component class with React.createDescriptor
. In preparation for this, coffee-react-transform now outputs calls to React.createElement
to construct element descriptors from component classes for you, so you won't need to wrap your classes using React.createFactory
. However, for this to work you will need to be using at least React 0.11.2, which adds React.createElement
.
If you want the older style JSX output (which just desugars into function calls) then you need to use the 0.x branch, eg. 0.5.1.
cake test
or cake watch:test
FAQs
React JSX support for Coffeescript
The npm package coffee-react-transform receives a total of 11,484 weekly downloads. As such, coffee-react-transform popularity was classified as popular.
We found that coffee-react-transform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.