
Research
TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.
react-script-tag-18
Advanced tools
React Script Tag 18, updated a four year old package that had a very well written script loader tag utility for react, updating to now use TypeScript and React 18
This react component is intended to be a drop-in replacement for the <script>
html native tag. After you add it in any location of your react-app, the component
will take care on appending the corresponding script tag to your app's document.
It supports all the native
attributes as
well.
Keywords: Blazing fast 🔥, Minimal 📦, and Simple 🤖
You can install this package thru npm or yarn:
yarn install react-script-tag-18
You can use the Script component anywhere. Once it is mounted, the component
will proceed to load your script.
import React from 'react';
import Script from '@gumgum/react-script-tag';
const MyProfileComponent = () => {
const [jsLoaded , setJsLoaded] = React.useState(false);
render() {
return (
<div>
<div className="some-class-that-relies-on-profile-js" style={{
alignItems: 'center',
verticalAlign: 'middle',
textAlign: 'center',
display: 'flex-box',
justifyContent: 'center',
}}>
</div>
<ScriptLoader src="https://platform.linkedin.com/badges/js/profile.js"
delayMs={30}
onLoad={() => {
console.log('My Profile.js script Loaded');
setLinkedLoaded(true); // set some state variable to initiate a re-render
}}
/>
</div>
);
}
}
export default MyProfileComponent;
It is recommended that the
Scripttag is placed in a component that only renders once in the entire life of your app. Otherwise, a new<script>tag will be appended each time the component mounts again. There are plans down the road to prevent this.
At GumGum, we usually wrap the Script component as follow, to facilitate
adding 3rd-parties. Here is an example, on how we add Qualaroo:
import Script from '../common/ScriptLoader';
import React from 'react';
class QualarooLoader extends React.Component {
_onCreate = () => {
window._kiq = window._kiq || [];
};
_onSuccess = () => {
const userStr = localStorage.getItem('user');
const user = JSON.parse(userStr);
if (!user) return;
const email = user.email;
window._kiq.push(['identify', email]);
};
_onError = error => {
throw new Error(`Could not load ${error.outerHTML}`);
};
render() {
return (
<Script
src="//s3.amazonaws.com/ki.js/<id>/fFn.js"
type="text/javascript"
onCreate={this._onCreate}
onSuccess={this._onSuccess}
onError={this._onError}
defer
/>
);
}
}
export default QualarooLoader;
We strongly suggest using the attributes
asyncanddefer(depending on your situation). Here is a good explanation.
Then we call our new wrapper in our app:
import React from 'react';
import Qualaroo from 'QualarooLoader';
class MyApp extends React.Component {
/* ... */
render() {
return (
<>
{/* Other Components */}
<Qualaroo delayMs={500}/>
</>
);
}
}
string| required
URI that specifies the location of your script.
number| defaults to0
Artifically adds a delay in milliseconds after the component mounts, but before the script tag is appended to the document. Useful for scripts that are not necessary early on, and may conflict on the browser's request-limit.
function()| defaults toFunction.prototype
A callback function that is called just right after the script tag has been
appended to the document.
function(event: Event)| defaults toFunction.prototype
This function is called after the script has been successfully loaded.
function(error: Event)| defaults tothrow new URIError(...)
If there is a problem loading your script, this function is called.
As stated previously, this component supports all the
attributes
that the html script tag supports. You simply have to pass it as props to the
<Script> component. In fact, any other prop that is not listed above will
be appended as-is to the native script tag.
We have tested it with the following attributes: type, chartset, async,
defer, crossOrigin, and noModule. (Everything else should work
nevertheless).
Feel free to file an issue to suggest changes!
Thanks goes to these people (emoji key):
Jose Santos 💻 📖 ⚠️ 👀 🐛 💡 🤔 | Serge Basile 🤔 |
|---|
This project follows the all-contributors specification. Contributions of any kind welcome!
MIT
FAQs
React Script Tag 18, updated a five year old package that had a very well written script loader tag utility for react, updating to now use TypeScript and React 18
The npm package react-script-tag-18 receives a total of 30 weekly downloads. As such, react-script-tag-18 popularity was classified as not popular.
We found that react-script-tag-18 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.