
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A React-like library with reactive signals and computed values for building dynamic web applications
⚠️ Proof of Concept Warning ⚠️
This project is currently a proof of concept and is not suitable for production use. It's designed to explore reactive programming patterns and demonstrate an alternative approach to React. Use at your own risk!
Signals are fundamentally better than React hooks because:
Pure TypeScript is better than JSX because:
npm install domitor
Ready to build reactive apps without the React complexity? Let's dive in! 🏊♂️
import { signal, computed, div, h1, p, button, render } from 'domitor';
// Create global reactive signals - accessible anywhere in your app
const count = signal(0);
const user = signal({ name: 'John', email: 'john@example.com' });
// Create a component
const Counter = () => {
// Create a local computed value
const doubleCount = computed(() => count.get() * 2);
// Create a reactive element
return div(
{ className: 'counter' },
h1('Counter Example'),
p('Count: ', count),
p('Double Count: ', doubleCount),
p('User: ', user.get().name),
button(
{
onClick: () => count.set(count.get() + 1),
},
'Increment',
),
);
};
// Another component can access the same global state
const UserProfile = () => {
return div(
{ className: 'profile' },
h1('User Profile'),
p('Name: ', user.get().name),
p('Email: ', user.get().email),
);
};
// Render to DOM
render(Counter(), document.getElementById('app'));
For development setup, building, testing, and project structure, see DEVELOPMENT.md.
For detailed API documentation, see API.md.
signal<T>(initialValue: T): Signal<T>Creates a reactive signal with an initial value.
const count = signal(0);
count.set(5); // Update value
console.log(count.get()); // Get current value
computed<T>(fn: () => T): Computed<T>Creates a computed value that automatically updates when dependencies change.
const doubleCount = computed(() => count.get() * 2);
render(element: HTMLElement, container: HTMLElement): voidRenders a reactive element into a DOM container.
render(Counter(), document.getElementById('app'));
All HTML elements are available as factory functions:
import { div, h1, p, button, input, span } from 'domitor';
const element = div(
{ className: 'container' },
h1({ children: 'Hello World' }),
p({ children: 'This is a paragraph' }),
button({ onClick: handleClick, children: 'Click me' }),
);
The examples/ directory contains comprehensive examples demonstrating Domitor features:
/counter): Basic reactive state management with increment/decrement buttons/random-generator): Signal updates with automatic UI re-rendering/debug): Reactive signals with disabled states and real-time logging/router): Advanced client-side routing with navigation and error handling/strongly-typed-props): Demonstrates TypeScript type safety for all HTML element propsEach example demonstrates different aspects of Domitor:
# Run all examples simultaneously
./examples/run-all.sh
# Or run individual examples
cd examples/counter && npm install && npm run dev
cd examples/router && npm install && npm run dev
cd examples/strongly-typed-props && npm install && npm run dev
Each example runs on a different port:
http://localhost:5173http://localhost:5174http://localhost:5175http://localhost:5176http://localhost:3000For detailed information about each example, see the Examples README.
We welcome contributions! Please see our Contributing Guide for details.
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
A React-like library with reactive signals and computed values
We found that domitor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.