
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
react-addons-create-fragment
Advanced tools
Note: This is a legacy React addon, and is no longer maintained.
We don't encourage using it in new code, but it exists for backwards compatibility.
The recommended migration path is to use arrays with explicit keys on individual elements.
Importing
import createFragment from 'react-addons-create-fragment'; // ES6
var createFragment = require('react-addons-create-fragment'); // ES5 with npm
If you prefer a <script>
tag, you can get it from React.addons.createFragment
with:
<!-- development version -->
<script src="https://unpkg.com/react-addons-create-fragment/react-addons-create-fragment.js"></script>
<!-- production version -->
<script src="https://unpkg.com/react-addons-create-fragment/react-addons-create-fragment.min.js"></script>
In this case, make sure to put the <script>
tag after React.
In most cases, you can use the key
prop to specify keys on the elements you're returning from render
. However, this breaks down in one situation: if you have two sets of children that you need to reorder, there's no way to put a key on each set without adding a wrapper element.
That is, if you have a component such as:
function Swapper(props) {
let children;
if (props.swapped) {
children = [props.rightChildren, props.leftChildren];
} else {
children = [props.leftChildren, props.rightChildren];
}
return <div>{children}</div>;
}
The children will unmount and remount as you change the swapped
prop because there aren't any keys marked on the two sets of children.
To solve this problem, you can use the createFragment
add-on to give keys to the sets of children.
Array<ReactNode> createFragment(object children)
Instead of creating arrays, we write:
import createFragment from 'react-addons-create-fragment';
function Swapper(props) {
let children;
if (props.swapped) {
children = createFragment({
right: props.rightChildren,
left: props.leftChildren
});
} else {
children = createFragment({
left: props.leftChildren,
right: props.rightChildren
});
}
return <div>{children}</div>;
}
The keys of the passed object (that is, left
and right
) are used as keys for the entire set of children, and the order of the object's keys is used to determine the order of the rendered children. With this change, the two sets of children will be properly reordered in the DOM without unmounting.
The return value of createFragment
should be treated as an opaque object; you can use the React.Children
helpers to loop through a fragment but should not access it directly. Note also that we're relying on the JavaScript engine preserving object enumeration order here, which is not guaranteed by the spec but is implemented by all major browsers and VMs for objects with non-numeric keys.
15.5.3 (April 7, 2017)
Note: this release has a critical issue and was deprecated. Please update to 15.5.4 or higher.
FAQs
Unknown package
The npm package react-addons-create-fragment receives a total of 119,979 weekly downloads. As such, react-addons-create-fragment popularity was classified as popular.
We found that react-addons-create-fragment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.