
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
react-async-script-hoc
Advanced tools
Load 3rd party scripts and styles from a url in a higher order component
yarn add react-async-script-hoc
This is a simple little higher-order component (HOC) for loading scripts from a url
and giving it to you in props instead of window.
Some 3rd party vendors don't make npm packages for their scripts & you must load them from a url.
This really sucks, but it's usually to comply with regulations (Stripe.js, ReCaptcha, etc.)
For example, with Stripe, instead of adding a script tag, you can use this & then get window.Stripe as a prop.
For styles, this might be useful if you're using a 3rd party package that comes with CSS but you prefer CSS-in-JS.
You can also return a method (or a promisified method) instead of the whole global object.
Yay modularity & lazy loading!
##Usage
Example:
import withAsync from 'react-async-hoc';
const statelessComponent = (props) => {
const {stripe} = props;
// undefined if the script hasn't loaded yet
if (!stripe) {
return <Loading/>
}
onEventHandler = () => {
stripe.stealMoney();
}
return <div onClick={onEventHandler}>I can haz?</div>
}
const stripeCb = () => {
const stripe = window.Stripe;
stripe.setPublishableKey(stripeKey);
return {
stripe,
// example of returning a promisified method when the API doesn't follow a node standard callback
createToken: (fields) => new Promise((resolve) => {
stripe.card.createToken(fields, (status, response) => {
resolve(response);
})
})
};
};
return withAsync({'https://js.stripe.com/v2/': stripeCb});
##API
withAsync(fetchScripts, fetchStyles)
fetchScripts: An object containing all the scripts you want to fetch.
If you don't know this until runtime, have the parent component pass in a fetchScripts property.
Pass in as many scripts as you want to load.
key: the url of the script to fetchvalue: the callback to run one that script has been loadedfetchStyles: Identical to fetchScripts, but for loading CSS.MIT
FAQs
a hoc for async globals
We found that react-async-script-hoc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.