
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-floatybox
Advanced tools
A React component for positioning floating components such as tooltips, dropdowns, selects etc. Avoids screen edges!
A React component for positioning floating components such as tooltips, dropdowns, selects etc. Avoids screen edges!
yarn add react-floatybox
import React from 'react';
import {useCallback} from 'react';
import FloatyBox from 'react-floatybox';
const Basic = (props) => {
let tooltip = useCallback(() => {
return <div>I am a tooltip</div>;
}, []);
return <FloatyBox open="hover" bubble={tooltip}>hover over me!</FloatyBox>;
};
import React from 'react';
import {useCallback} from 'react';
import FloatyBox from 'react-floatybox';
import Point from 'react-floatybox/Point';
const WithTail = (props) => {
let tooltip = useCallback(({tailProps}) => {
return <div>I am a tooltip <Point {...tailProps} color="#000" /></div>;
}, []);
return <FloatyBox open="hover" bubble={tooltip} tailSize={20}>hover over me!</FloatyBox>
};
import React from 'react';
import {useCallback} from 'react';
import FloatyBox from 'react-floatybox';
const Basic = (props) => {
let tooltip = useCallback(() => {
return <div>I am a thing</div>;
}, []);
return <FloatyBox open="click" side="top" align="left" bubble={tooltip}>click me!</FloatyBox>;
};
children: React.Node
The React element that the bubble is tethered to, called the "anchor". It can handle click and hover events to control the open state of the bubble.
bubble: ({close, isOpen, tailProps}) => React.Node
A function for FloatyBox to call to render the floaty box.
It's recommended you wrap this in a useCallback hook to improve rendering performance.
The function is passed an object with a few properties:
| close | () => void | A function that can be called from inside the bubble to close itself. |
| isOpen | boolean | A boolean indicating if the bubble is open. |
| tailProps | {side: string, size: number, style: Object} | An object that can be spread onto a tail component such as react-floatybox/Point. |
open?: "click"|"hover"|"always" // optional
If provided, this sets the kind of interaction that will open and close the bubble.
side: "top"|"bottom"|"left"|"right" = "top"
Chooses the preferred side of the anchor that the bubble should appear on.
align: string = "center"
Sets the bubble's preferred alignment in relation to its tail.
side is "top" or "bottom", valid values are "center", "left" or "right".side is "left" or "right", valid values are "center", "up" or "down".alignInner: string = "center"
Sets the tail's preferred alignment in relation to the anchor.
When building things with small anchors and large bubbles, such as tooltips, this prop is usually best on its default "center" setting. But if your anchor is larger than your bubble then this alignment becomes more useful.
side is "top" or "bottom", valid values are "center", "left" or "right".side is "left" or "right", valid values are "center", "up" or "down".flip: boolean = false
Set to true to allow FloatyBox to flip the bubble to the opposite side of the anchor if there is not enough space to fit it on the preferred side.
slide: boolean = false
Set to true to allow FloatyBox to slide the bubble across the side of the anchor if there is not enough space to fit it at the preferred alignment.
trap: boolean = false
Trap will prevent the bubble from ever leaving the screen.
gap: number = 10
The gap between the bubble and the anchor, in pixels.
edge: number = 10
How close the bubble is allowed to be posiitioned near a screen edge, in pixels.
zIndex: number = 100
The zIndex of the bubble element.
closeOnOutsideClick: boolean = true
A react-useportal option that lets the bubble close when you click outside of it.
closeOnEsc: boolean = true
A react-useportal option that lets the bubble close when you press the escape key.
tailSize?: number // optional
If a tail is used on your bubble, tailSize must be set so FloatyBox can adjust its positioning.
wrap: React.Component = "span"
The component that the FloatyBox anchor gets wrapped in.
forceUpdate: Array<any> = []
The forceUpdate prop allows you to force the bubble position to update. Pass it an array of values, and when any of these values change then the bubble position will be recalculated.
isOpen?: boolean // optional
If provided, FloatyBox won't keep its own state and will just be open when this boolean is true.
onChange?: (isOpen: boolean) => void (optional)` // optional
If provided along with isOpen, this will be called when FloatyBox wants to change state.
React-floatybox is written and maintained by Damien Clarke, with feedback from others at 92green. All online library discussion happens over on Github.
I hope this library helps solve some React positioning problems for you. 🎉
FAQs
A React component for positioning floating components such as tooltips, dropdowns, selects etc. Avoids screen edges!
The npm package react-floatybox receives a total of 13 weekly downloads. As such, react-floatybox popularity was classified as not popular.
We found that react-floatybox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.