
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
react-script-tag-18
Advanced tools
React Script Tag 18, updated a five year old package that had a very well written script loader tag utility for react, updating to now use TypeScript and React 18
This react component is intended to be a drop-in replacement for the <script>
html native tag. After you add it in any location of your react-app, the component
will take care on appending the corresponding script tag to your app's document.
It supports all the native
attributes as
well.
Keywords: Blazing fast 🔥, Minimal 📦, and Simple 🤖
You can install this package thru npm or yarn:
yarn install react-script-tag-18
You can use the Script
component anywhere. Once it is mounted, the component
will proceed to load your script.
import React from 'react';
import ScriptTag from 'react-script-tag-18';
const MyProfileComponent = () => {
const [jsLoaded , setJsLoaded] = React.useState(false);
render() {
return (
<div>
<div className="some-class-that-relies-on-profile-js" style={{
alignItems: 'center',
verticalAlign: 'middle',
textAlign: 'center',
display: 'flex-box',
justifyContent: 'center',
}}>
</div>
<ScriptTag src="https://platform.linkedin.com/badges/js/profile.js"
delayMs={500}
onLoad={() => {
console.log('My Profile.js script Loaded');
setJsLoaded(true); // set some state variable to initiate a re-render
}}
async={true}
/>
</div>
);
}
}
export default MyProfileComponent;
It is recommended that the
Script
tag is placed in a component that only renders once in the entire life of your app. Otherwise, a new<script>
tag will be appended each time the component mounts again. There are plans down the road to prevent this.
<!DOCTYPE html>
<html>
<head>
<title>react-script-tag-18 cdn demo</title>
<script src="https://cdn.jsdelivr.net/npm/react@18/umd/react.development.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/react-dom@18/umd/react-dom.production.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/react-script-tag-18@5.2.0/lib/react-script-tag.umd.min.js"></script>
</head>
<body>
<div id="root"></div>
<script async="true" type="text/javascript">
console.info('React version:', React.version);
const ScriptTag = window.ScriptTag;
// state loaded
const ScriptTagELemWrapperDiv = () => {
const [loaded, setLoaded] = React.useState(false);
const [countdown, setCountdown] = React.useState(5);
React.useEffect(() => {
const interval = setInterval(() => {
setCountdown((prevCountdown) => prevCountdown - 1);
}, 1000);
return () => clearInterval(interval);
}, []);
const ScriptTagElem = React.createElement('div', {
children: React.createElement(ScriptTag, {
src: 'https://platform.twitter.com/widgets.js',
type: 'text/javascript',
async: true,
delayMs: 4950,
onLoad:() => {
console.log('Script loaded');
setLoaded(true);
},
children: loaded ? 'Script loaded' : 'Script will be loaded in ' + countdown + (countdown === 1 ? ' second' : ' seconds'),
}),
});
return ScriptTagElem;
}
ReactDOM.render(React.createElement(ScriptTagELemWrapperDiv), document.getElementById('root'));
</script>
</body>
</html>
At GumGum, we usually wrap the Script
component as follow, to facilitate
adding 3rd-parties. Here is an example, on how we add Qualaroo:
import Script from '../common/ScriptLoader';
import React from 'react';
class QualarooLoader extends React.Component {
_onCreate = () => {
window._kiq = window._kiq || [];
};
_onSuccess = () => {
const userStr = localStorage.getItem('user');
const user = JSON.parse(userStr);
if (!user) return;
const email = user.email;
window._kiq.push(['identify', email]);
};
_onError = error => {
throw new Error(`Could not load ${error.outerHTML}`);
};
render() {
return (
<Script
src="//s3.amazonaws.com/ki.js/<id>/fFn.js"
type="text/javascript"
onCreate={this._onCreate}
onSuccess={this._onSuccess}
onError={this._onError}
defer
/>
);
}
}
export default QualarooLoader;
We strongly suggest using the attributes
async
anddefer
(depending on your situation). Here is a good explanation.
Then we call our new wrapper in our app:
import React from 'react';
import Qualaroo from 'QualarooLoader';
class MyApp extends React.Component {
/* ... */
render() {
return (
<>
{/* Other Components */}
<Qualaroo delayMs={500}/>
</>
);
}
}
string
| required
URI that specifies the location of your script.
number
| defaults to0
Artifically adds a delay in milliseconds after the component mounts, but before the script tag is appended to the document. Useful for scripts that are not necessary early on, and may conflict on the browser's request-limit.
function()
| defaults toFunction.prototype
A callback function that is called just right after the script
tag has been
appended to the document.
function(event: Event)
| defaults toFunction.prototype
This function is called after the script has been successfully loaded.
function(error: Event)
| defaults tothrow new URIError(...)
If there is a problem loading your script, this function is called.
As stated previously, this component supports all the
attributes
that the html script
tag supports. You simply have to pass it as props to the
<Script>
component. In fact, any other prop that is not listed above will
be appended as-is to the native script
tag.
We have tested it with the following attributes: type
, chartset
, async
,
defer
, crossOrigin
, and noModule
. (Everything else should work
nevertheless).
Feel free to file an issue to suggest changes!
Thanks goes to these people (emoji key):
Jose Santos 💻 📖 ⚠️ 👀 🐛 💡 🤔 | Serge Basile 🤔 |
---|
This project follows the all-contributors specification. Contributions of any kind welcome!
MIT
FAQs
React Script Tag 18, updated a five year old package that had a very well written script loader tag utility for react, updating to now use TypeScript and React 18
The npm package react-script-tag-18 receives a total of 109 weekly downloads. As such, react-script-tag-18 popularity was classified as not popular.
We found that react-script-tag-18 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.