
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
react-debug-updates
Advanced tools
See why React components re-render — visual overlays, console logging, and hook-level cause detection with zero code changes
See exactly which React components re-render, how often, how long they take, and why — all without modifying your components.
Created and used at Screen Studio.
I needed to debug React re-render performance in an Electron app, but I could never get the official React DevTools to work with Electron. The integration is fragile, poorly documented, and breaks between versions. I just needed to see which components were re-rendering.
So I wrote this — a plug-and-play one-liner that gives you visual highlight overlays and console logging for React re-renders. No browser extension, no Electron hacks, no configuration. Works in any React web environment — browsers, Electron, iframes.
Hooks into __REACT_DEVTOOLS_GLOBAL_HOOK__ to intercept every React commit. Detects re-rendered components using the exact same fiber tree diffing approach as the official React DevTools — following their original implementation of didFiberRender and parallel tree walking. No React DevTools extension required. No wrappers, no HOCs, no code changes — just call startReactUpdatesMonitor() and you get:
useState, useReducer, useSyncExternalStore, or useContext hook triggered each re-render, with previous→next valuesnpm install react-debug-updates
# or
yarn add react-debug-updates
# or
pnpm add react-debug-updates
Import and call startReactUpdatesMonitor before React renders anything — ideally at the very top of your entry point. This ensures the hook is in place before the first commit.
import { startReactUpdatesMonitor } from "react-debug-updates";
// One-liner — visual highlights out of the box
const stop = startReactUpdatesMonitor();
// Later, to clean up:
stop();
if (process.env.NODE_ENV === "development") {
const { startReactUpdatesMonitor } = await import("react-debug-updates");
startReactUpdatesMonitor();
}
startReactUpdatesMonitor({
reasonOfUpdate: true,
logToConsole: true,
highlightOpacity: 0.5,
highlightShowLabels: false,
});
__REACT_DEVTOOLS_GLOBAL_HOOK__) — no browser extension neededreasonOfUpdate and render durations: React must be in dev mode (provides _debugHookTypes and actualDuration on fibers)startReactUpdatesMonitor(options?): () => voidReturns a stop function to unhook from React and remove all overlays. Throws if called in a non-browser environment (e.g. SSR).
| Option | Type | Default | Description |
|---|---|---|---|
mode | "self-triggered" | "all" | "self-triggered" | "self-triggered" tracks only components whose own state changed. "all" includes children swept by parent updates |
reasonOfUpdate | boolean | false | Detect and display why each component re-rendered |
logToConsole | boolean | false | Log re-renders to the console |
highlight | boolean | true | Enable visual highlight overlays |
highlightShowLabels | boolean | true | Show text labels (name, count, duration, cause) above highlights |
highlightOpacity | number | 0.8 | Peak opacity of highlight overlays (0–1) |
highlightFlushInterval | number | 250 | Milliseconds between highlight flush cycles |
highlightAnimationDuration | number | 1200 | Highlight fade-out animation duration (ms) |
UpdateCause| Property | Type | Description |
|---|---|---|
kind | "hook" | "props" | "class-state" | "unknown" | Category of the cause |
hookIndex | number? | Source-order index of the hook (0-based) |
hookType | string? | e.g. "useState", "useReducer", "useContext" |
previousValue | unknown? | Previous hook state value |
nextValue | unknown? | New hook state value |
⚛ 3 re-renders
Counter App → Dashboard (0.42ms)
↳ useState[0]: 5 → 6
TodoList App → Dashboard (1.03ms)
↳ props changed (parent re-rendered)
Sidebar App (0.15ms)
↳ useContext changed
Re-rendered components get a highlight box that fades out. The color shifts from blue to red as the same node re-renders repeatedly within a flush window — making "hot" components visually obvious.
Each highlight label shows: ComponentName ×count duration (cause)
MIT
FAQs
See why React components re-render — visual overlays, console logging, and hook-level cause detection with zero code changes
The npm package react-debug-updates receives a total of 1,595 weekly downloads. As such, react-debug-updates popularity was classified as popular.
We found that react-debug-updates demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.