
Security News
/Research
Compromised Injective SDK npm Package Exfiltrates Wallet Keys and Mnemonics
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.
instaskeleton
Advanced tools
Ultra-light React skeleton loader with zero DOM scanning, zero layout measurement, and zero lag.
~1.2 KB gzipped (JS) + ~0.45 KB (CSS) = ~1.65 KB total
Most skeleton libraries either:
instaskeleton takes a different approach:
prefers-reduced-motionnpm install instaskeleton
Import the bundled styles once:
import 'instaskeleton/styles.css';
Use inference when you want the fastest setup:
import { InstaSkeleton } from 'instaskeleton';
import 'instaskeleton/styles.css';
type Product = {
title: string;
price: string;
};
function ProductCard({
loading,
product
}: {
loading: boolean;
product: Product;
}) {
return (
<InstaSkeleton loading={loading} infer cacheKey="product-card-v1">
<article>
<img src="/cover.png" alt="" />
<h3>{product.title}</h3>
<p>{product.price}</p>
<button>Add to cart</button>
</article>
</InstaSkeleton>
);
}
Use manual schema when you want the skeleton to resemble the inner component structure more closely.
import { InstaSkeleton, type SkeletonNode } from 'instaskeleton';
const articleCardSchema: SkeletonNode[] = [
{ type: 'rect', height: '12rem', radius: '1rem' },
{ type: 'line', width: '68%' },
{ type: 'line', width: '92%' },
{ type: 'line', width: '40%' }
];
function ArticleCard({ loading }: { loading: boolean }) {
return (
<InstaSkeleton loading={loading} schema={articleCardSchema} infer={false}>
<article>
<img src="/hero.png" alt="" />
<h3>How we removed DOM scanning from loading states</h3>
<p>Manual schema mirrors the actual card anatomy.</p>
<small>5 min read</small>
</article>
</InstaSkeleton>
);
}
Use withInstaSkeleton when you want to preconfigure loading behavior for a reusable component.
import { withInstaSkeleton } from 'instaskeleton';
function StatCard({ label, value }: { label: string; value: string }) {
return (
<div>
<span>{label}</span>
<strong>{value}</strong>
</div>
);
}
const StatCardWithSkeleton = withInstaSkeleton(StatCard, {
skeleton: [
{ type: 'line', width: '35%', height: '0.75rem' },
{ type: 'rect', height: '3rem', radius: '0.75rem' }
],
infer: false,
cacheKey: 'stat-card'
});
<StatCardWithSkeleton loading={isLoading} label="Downloads" value="12.4k" />;
<InstaSkeleton>The main component for wrapping content with skeleton loading states.
| Prop | Type | Default | Description |
|---|---|---|---|
loading | boolean | required | Show skeleton when true, children when false |
children | ReactNode | required | Content to display when not loading |
schema | SkeletonNode | SkeletonNode[] | undefined | Manual skeleton definition |
infer | boolean | true | Auto-generate skeleton from children |
cacheKey | string | undefined | Cache inferred schema for reuse |
className | string | undefined | Additional CSS class for the skeleton root |
animation | 'shimmer' | 'pulse' | 'none' | 'shimmer' | Animation style |
inferOptions | InferOptions | {} | Control inference behavior |
InferOptionsFine-tune the inference algorithm:
| Option | Type | Default | Description |
|---|---|---|---|
maxDepth | number | 6 | Maximum JSX tree depth to traverse |
maxNodes | number | 120 | Maximum nodes to process |
textLineHeight | string | number | '0.95rem' | Height for text line skeletons |
withInstaSkeleton(Component, options)HOC to create a skeleton-wrapped version of any component.
const WrappedComponent = withInstaSkeleton(MyComponent, {
skeleton: [...], // Manual schema
infer: false, // Disable inference
cacheKey: 'my-comp', // Cache key
className: 'custom', // Root class
animation: 'pulse', // Animation style
});
// Adds `loading` prop to the component
<WrappedComponent loading={isLoading} {...props} />
clearInstaSkeletonCache(key?)Clear cached schemas:
import { clearInstaSkeletonCache } from 'instaskeleton';
// Clear specific cache entry
clearInstaSkeletonCache('product-card');
// Clear all cached schemas
clearInstaSkeletonCache();
SkeletonNodeSupported node types:
line — Text placeholder{ type: 'line', width: '80%', height: '1rem' }
rect — Block placeholder (images, buttons, cards){ type: 'rect', width: '100%', height: '8rem', radius: '1rem' }
circle — Avatar or icon placeholder{ type: 'circle', width: '3rem', height: '3rem' }
group — Container for nested nodes{
type: 'group',
gap: '0.75rem',
children: [
{ type: 'circle', width: '3rem', height: '3rem' },
{ type: 'line', width: '60%' },
{ type: 'line', width: '40%' },
]
}
// When loading=false, InstaSkeleton returns children immediately
// No inference, no schema processing, no DOM overhead
if (!loading) return <>{children}</>;
Schemas are cached with a 100-entry limit to prevent memory leaks in long-running SPAs.
Shimmer animation uses will-change: transform for 60fps performance.
Animations are disabled automatically when prefers-reduced-motion: reduce is set.
| Use Case | Mode | Why |
|---|---|---|
| Quick prototyping | infer | Zero config, good approximation |
| Production cards with specific layout | schema | Pixel-perfect control |
| Reusable components | withInstaSkeleton | Consistent API, one config |
| Lists with repeated items | infer + cacheKey | Cached after first render |
| Complex nested structures | infer + inferOptions | Tune depth/node limits |
The local example app is a comprehensive visual reference covering:
Run it from the repo root:
npm run example:install
npm run example:dev
npm run build # Build the library
npm run typecheck # Run TypeScript checks
npm run dev # Watch mode
npm run example:dev # Run example app
MIT © LittleBoy9
FAQs
Ultra-light React skeleton loader with zero DOM scanning. Automatic JSX inference, manual schema support, shimmer & pulse animations. Only ~1.65KB gzipped.
The npm package instaskeleton receives a total of 16 weekly downloads. As such, instaskeleton popularity was classified as not popular.
We found that instaskeleton demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.

Security News
npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

Research
/Security News
Socket tracks the activity as Operation “Muck and Load”: a threat actor uses commit-farming workflows, public dead drops, and protected archives to stage Windows RAT and infostealer malware.