
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
react-redux-default-export
Advanced tools
This is a fork of the official React Redux library. The only difference is that it also
exports a ReactRedux object as default export. This is useful for those old libraries which try to import stuff from react-redux. making your libraries fail to load.
Official React bindings for Redux.
Performant and flexible.
The recommended way to start new apps with React Redux is by using the official Redux+JS/TS templates for Create React App, which takes advantage of Redux Toolkit.
# JS
npx create-react-app my-app --template redux
# TS
npx create-react-app my-app --template redux-typescript
React Redux 8.0 requires React 16.8.3 or later (or React Native 0.59 or later).
To use React Redux with your React app, install it as a dependency:
# If you use npm:
npm install react-redux
# Or if you use Yarn:
yarn add react-redux
You'll also need to install Redux and set up a Redux store in your app.
This assumes that you’re using npm package manager with a module bundler like Webpack or Browserify to consume CommonJS modules.
If you don’t yet use npm or a modern module bundler, and would rather prefer a single-file UMD build that makes ReactRedux available as a global object, you can grab a pre-built version from cdnjs. We don’t recommend this approach for any serious application, as most of the libraries complementary to Redux are only available on npm.
The React Redux docs are published at https://react-redux.js.org .
The post The History and Implementation of React-Redux explains what it does, how it works, and how the API and implementation have evolved over time.
There's also a Deep Dive into React-Redux talk that covers some of the same material at a higher level.
FAQs
Un-official React bindings for Redux
We found that react-redux-default-export demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.