
Research
/Security News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
formaldehyde
Advanced tools
React form creation/validation/population. Supports top-down rendering with input population. Keeps the immutable data structures mindset.
React form creation/validation/population. Supports top-down rendering with input population. Keeps the immutable data structures mindset.
We needed something elegant for creating forms and inputs that self populate, require no state, and at a input AND form levels, have easy use for validation.
$ npm i formaldehyde
# CreateUserForm.js
import React from 'react';
import { Form, Input, SubmitButton } from 'formaldehyde';
export default class CreateUserForm extends React.Component {
onSuccess (result) {
// if there is no action on the Form or if it returns nothing, this gets called immiediately
// otherwise if the action returns a promise, it will wait for it to finish
// the result is the result of the promise.
this.props.navigate(result.id);
}
onFormValidate (model) { // this function returns an array of errors.
const errors = [];
if (!model.agree) {
errors.push('You need to agree to the terms');
}
return errors;
}
render () {
return (
<Form action={ this.props.action } onSuccess={ ::this.onSuccess } validateForm={ ::this.onFormValidate } model={ {} } showValidationErrors>
<p>
<Input type="text" name="full_name" placeholder="Full Name" required />
</p>
<p>
<Input type="checkbox" name="agree" />
</p>
<p>
<SubmitButton className="button">Create User</SubmitButton>
</p>
</Form>
);
}
}
The built-in formaldehyde inputs use their name prop to get data off of the Form's model prop object.
So if <Form model={{ product: { name:'formaldehyde' } }}> has a child Input that looks like <Input name="product.name" /> it will get the model's product.name, "formaldehyde".
It will pre-populate the input with that data as well as use that to set the model when it is being submitted.
Since Formaldehyde uses React Context, you will need to implement registering the component, unregistering it, and getting the data from your component when its about to be submitted or validated.
static contextTypes = {
registerFormControl: PropTypes.func.isRequired,
unregisterFormControl: PropTypes.func.isRequired,
};
We will register the component on componentDidMount and unregister on componentWillUnmount. Here is an example of the most simple way to handle it.
export default class MyIput extends React.Component {
static contextTypes = {
registerFormControl: PropTypes.func.isRequired,
unregisterFormControl: PropTypes.func.isRequired,
};
constructor (...args) {
super(...args);
this.state = {};
}
componentDidMount () {
this.context.registerFormControl(this);
if (this.props.autofocus) {
this.refs.input.focus();
}
}
componentWillUnmount () {
this.context.unregisterFormControl(this);
}
}
Now we will need to implement the method getValue that the Form will use to gather the data, remember it will automatically read the prop name passed to your custom input.
export default class MyIput extends React.Component {
static contextTypes = {
registerFormControl: PropTypes.func.isRequired,
unregisterFormControl: PropTypes.func.isRequired,
};
constructor (...args) {
super(...args);
this.state = {};
}
componentDidMount () {
this.context.registerFormControl(this);
if (this.props.autofocus) {
this.refs.input.focus();
}
}
componentWillUnmount () {
this.context.unregisterFormControl(this);
}
getValue () {
return this.state.value; // getValue is automatically invoked after being register when the Form is submitted.
}
}
So we have another context call back we can use. getFormModelValue(name).
export default class MyIput extends React.Component {
static contextTypes = {
registerFormControl: PropTypes.func.isRequired,
unregisterFormControl: PropTypes.func.isRequired,
};
constructor (props, context) {
super(props, context);
this.state = {
value: context.getFormModelValue(props.name), // preload
};
}
componentDidMount () {
this.context.registerFormControl(this);
if (this.props.autofocus) {
this.refs.input.focus();
}
}
componentWillUnmount () {
this.context.unregisterFormControl(this);
}
getValue () {
return this.state.value; // getValue is automatically invoked after being register when the Form is submitted.
}
}
componentWillReceiveProps to re-set state, or in our case, we don't really use state for our inputs. Checkout the Input.js code for how that is handled without state.FAQs
React form creation/validation/population. Supports top-down rendering with input population. Keeps the immutable data structures mindset.
We found that formaldehyde demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Research
/Security News
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Product
Stay on top of alert changes with filtered subscriptions, batched summaries, and notification routing built for triage.