
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
coffee-react-transform
Advanced tools
This tool is no longer maintained. If you need to transition your codebase from it, a codemod is available to do so: cjsx-codemod
This project started as a way for me to explore how JSX could fit into Coffeescript syntax, as a quickly hacked together prototype. While I never really promoted it, it quickly took on a life of its own, and before long people were asking for it to support all kinds of different use cases. On top of that I had no experience writing parsers, so the result is something with insurmountable limitations.
As I eventually stopped using Coffeescript I ended up neglecting this project, but as people were using it I didn't want to kill it. I really should have, however, because it meant that people were using a crappy, ill-conceived, unmaintained tool. Now, long overdue, I'm putting it out to pasture.
Original readme follows:
Provides support for an equivalent of JSX syntax in Coffeescript (called CJSX) so you can write your React components with the full awesomeness of Coffeescript. Try it out.
car-component.coffee
Car = React.createClass
render: ->
<Vehicle doors={4} locked={isLocked()} data-colour="red" on>
<Parts.FrontSeat />
<Parts.BackSeat />
<p className="seat">Which seat can I take? {@props?.seat or 'none'}</p>
{# also, this is an inline comment}
</Vehicle>
transform
cjsx-transform car-component.coffee
output
Car = React.createClass
render: ->
React.createElement(Vehicle, {"doors": (4), "locked": (isLocked()), "data-colour": "red", "on": true},
React.createElement(Parts.FrontSeat, null),
React.createElement(Parts.BackSeat, null),
React.createElement("p", {"className": "seat"}, "Which seat can I take? ", (@props?.seat or 'none'))
)
coffee-react-transform simply handles preprocessing Coffeescript with JSX-style markup into valid Coffeescript. Instead of using it directly, you may want to make use of one of these more high-level tools:
coffee executable, for compiling CJSX.require CJSX files on the server (also possible with coffee-react/register).cjsx-transform [input file]
Outputs Coffeescript code to stdout. Redirect it to a file or straight to the Coffeescript compiler, eg.
cjsx-transform examples/car.coffee | coffee -cs > car.js
transform = require 'coffee-react-transform'
transformed = transform('...some CJSX code...')
From npm:
npm install -g coffee-react-transform
JSX/CJSX 'spread attributes' allow merging in an object of props when creating an element, eg:
extraProps = color: 'red', speed: 'fast'
<div color="blue" {...extraProps} />
which is transformed to:
extraProps = color: 'red', speed: 'fast'
React.createElement("div", Object.assign({"color": "blue"}, extraProps)
If you use this syntax in your code, be sure to include a shim for Object.assign for browsers/environments which don't yet support it. object.assign, core-js and
es6-shim are some possible choices.
If you want to use coffee-react-transform in the browser or under ExecJS or some other environment that doesn't support CommonJS modules, you can use this build provided by BrowserifyCDN, which will work as an AMD module or just a plain old script tag:
http://wzrd.in/standalone/coffee-react-transform
<script src="http://wzrd.in/standalone/coffee-react-transform"></script>
<script>
coffeeReactTransform('-> <a />');
// returns '-> React.createElement("a", null)'
</script>
npm test or cake test or cake watch:test
See CHANGELOG.md.
FAQs
React JSX support for Coffeescript
We found that coffee-react-transform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.