
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
form0-react
Advanced tools
React bindings for form0, the open-source schema-driven form ecosystem by paqu.io. Hooks and components that render a JSON form schema with your own design system.
[!NOTE] form0 is in active development and is available to use today. Its schema format and core concepts are stable in practice, but releases before 1.0 may include breaking changes. Pin your versions and review the release notes when upgrading. A formally stable release is coming.
form0-react is the React UI layer for the form0 ecosystem. It combines the
form0-core engine with accessible default field renderers while allowing applications to replace
the presentation with their own components and design system.
For a new project, install form0-cli and follow the
quickstart. Choose the web application option
to start from the maintained React and Vite template.
Install form0-react directly when integrating it into an existing React application.
npm install form0-react form0-core
Install compatible React peer dependencies if the application does not already provide them.
import { FormRenderer } from 'form0-react';
import 'form0-react/index.css';
const schema = {
form: {
name: 'Contact form',
status_field: null,
elements: [
{
type: 'TextField',
key: 'name',
data_name: 'name',
label: 'Name',
display: 'default',
description: null,
description_mode: null,
required: true,
required_conditions: null,
visible: true,
visible_conditions: null,
read_only: false,
read_only_conditions: null,
default_value: null,
pattern: null,
pattern_description: null,
supporting_image: false,
supporting_image_path: null,
supporting_image_display: null,
},
],
},
};
export function ContactForm() {
return <FormRenderer schema={schema} onSubmit={(record) => console.log(record)} />;
}
Applications can replace or extend field components without forking the package. Use the exported
field registry APIs or a FieldRegistryProvider to keep application-specific UI outside the form
engine.
FormRenderer also supports consumer-owned state and layout integration:
headerAccessory renders application UI between the form summary and body.externalDirty includes application-owned changes in discard confirmation.submitBlockedReason prevents submission while an external condition is unresolved.recordMetadataFields can provide read-only display data that never enters engine values.@vanilla-extract/css 1.17.4 or newerWorker mode requires a bundler that supports ESM module workers and rewrites
new Worker(new URL(..., import.meta.url), { type: 'module' }). Vite-based applications are
supported. FormRenderer uses the packaged worker when engineMode="worker"; custom worker URLs
and factories are not part of its public API.
Schema expressions are evaluated by form0-core. Only use schemas from trusted authors and review
the form0-core security policy.
Report vulnerabilities according to this repository's security policy.
See SUPPORT.md for help and CONTRIBUTING.md to contribute.
FAQs
React bindings for form0, the open-source schema-driven form ecosystem by paqu.io. Hooks and components that render a JSON form schema with your own design system.
We found that form0-react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.