
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
create-bouncecode-library
Advanced tools
CLI for creating reusable, modern React libraries using Rollup and create-react-app.
commonjs
and es
module formatsThis package requires node >= 10
.
npm install -g create-react-library
npx create-react-library
(npx comes with npm 5.2+ and higher, see instructions for older npm versions)
create-react-library
Answer some basic prompts about your module, and then the CLI will perform the following steps:
At this point, your new module should resemble this screenshot and is all setup for local development.
Local development is broken into two parts (ideally using two tabs).
First, run rollup to watch your src/
module and automatically recompile it into dist/
whenever you make changes.
npm start # runs rollup with watch flag
The second part will be running the example/
create-react-app that's linked to the local version of your module.
# (in another tab)
cd example
npm start # runs create-react-app dev server
Now, anytime you make a change to your library in src/
or to the example app's example/src
, create-react-app
will live-reload your local dev server so you can iterate on your component in real-time.
npm publish
This builds commonjs
and es
versions of your module to dist/
and then publishes your module to npm
.
Make sure that any npm modules you want as peer dependencies are properly marked as peerDependencies
in package.json
. The rollup config will automatically recognize them as peers and not try to bundle them in your module.
npm run deploy
This creates a production build of the example create-react-app
that showcases your library and then runs gh-pages
to deploy the resulting bundle.
If you use react-hooks in your project, when you debug your example you may run into an exception Invalid Hook Call Warning. This issue explains the reason, your lib and example use a different instance, one solution is rewrite the react
path in your example's package.json
to 'file:../node_modules/react' or 'link:../node_modules/react'.
Here is a branch which demonstrates how to use multiple named exports. The module in this branch exports two components, Foo
and Bar
, and shows how to use them from the example app.
Here is a branch which demonstrates how to make use of a relatively complicated peer dependency, material-ui. It shows the power of rollup-plugin-peer-deps-external which makes it a breeze to create reusable modules that include complicated material-ui subcomponents without having them bundled as a part of your module.
The CLI is based on this boilerplate, which you can optionally read about here.
Here are some example libraries that have been bootstrapped with create-react-library
.
Want to see a more completed list? Check out Made with CRL
Want to add yours to the list? Submit an PR at the Made with CRL repository.
My open source efforts are now focused on Saasify, and I am not able to invest a significant amount of time into maintaining CRL anymore. I am looking for volunteers who would like to become active maintainers on the project. If you are interested, please shoot me a note.
MIT © Travis Fischer
Support my OSS work by following me on twitter
FAQs
CLI for BounceCode library
We found that create-bouncecode-library demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.