
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
react-topography
Advanced tools
A CLI tool to generate a topography of React component relationships.
React Topography is a command-line tool that visualizes the component hierarchy and relationships in React applications. It generates an interactive static site displaying a flow from the root of the app to its components, allowing you to explore their connections.

pnpm install -g react-topography
Run the CLI from your project’s root directory, specifying the source directory where your React code resides (e.g., where main.tsx or app.tsx is located) using the -s flag.
react-topography -s <source-directory>
If your React code is in the src directory:
react-topography -s ./src
If your React code is in packages/demo/src:
react-topography -s ./packages/demo/src
After running the command, the tool spins up a static site at http://localhost:4001/. The site displays an interactive visualization of your React app’s component relationships, where you can:
React Topography currently supports React applications created with:
Note: Support for Next.js or Remix React apps is not yet available.
Feel free to report issues or contribute to the project on GitHub. We welcome feedback and improvements!
MIT
FAQs
A tool to generate a topography of React component relationships
We found that react-topography demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.