
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
immutable-reactfire
Advanced tools
ReactJS is a framework for building large, complex user
interfaces. Firebase complements it perfectly
by providing an easy-to-use, realtime data source for populating the state of React components.
With ReactFire, it only
takes a few lines of JavaScript to integrate Firebase into React apps via the ReactFireMixin.
Read through our documentation on using Firebase with React and check out our live Todo app demo to get started!
In order to use ReactFire in your project, you need to include the following files in your HTML:
<!-- React JS -->
<script src="https://fb.me/react-0.12.0.min.js"></script>
<script src="https://fb.me/JSXTransformer-0.12.0.js"></script>
<!-- Firebase -->
<script src="https://cdn.firebase.com/js/client/2.0.1/firebase.js"></script>
<!-- ReactFire -->
<script src="https://cdn.firebase.com/libs/reactfire/0.4.0/reactfire.min.js"></script>
Use the URL above to download both the minified and non-minified versions of ReactFire from the Firebase CDN. You can also download them from the releases page of this GitHub repository. Firebase and React can be downloaded directly from their respective websites.
You can also install ReactFire via npm or Bower and its dependencies will be downloaded automatically:
$ npm install reactfire --save
$ bower install reactfire --save
ReactFire requires Firebase in order to store data. You can sign up here for a free account.
To use the ReactFireMixin in a React component, add it to the component's mixins property:
var ExampleComponent = React.createClass({
mixins: [ReactFireMixin],
...
});
The ReactFire APIs will then be available from the this object inside of ExampleComponent.
The ReactFire quickstart is a great place to get started. There is a walkthrough on how to create the Todo app demo in the ReactFire guide. Finally, there is a full API reference as well.
If you'd like to contribute to ReactFire, you'll need to run the following commands to get your environment set up:
$ git clone https://github.com/firebase/reactfire.git
$ cd reactfire # go to the reactfire directory
$ npm install -g gulp # globally install gulp task runner
$ npm install -g bower # globally install Bower package manager
$ npm install # install local npm build / test dependencies
$ bower install # install local JavaScript dependencies
$ gulp watch # watch for source file changes
gulp watch will watch for changes in the /src/ directory and lint, concatenate, and minify the
source files when a change occurs. The output files - reactfire.js and reactfire.min.js - are
written to the /dist/ directory.
You can run the test suite by navigating to file:///path/to/reactfire/tests/index.html or via the
command line using gulp test.
FAQs
Firebase mixin for ReactJS
We found that immutable-reactfire demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.