
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
rn-nodeify
Advanced tools
Run after npm install and you can use node core modules and npm modules that use them in your React Native app.
Run after npm install and you can use node core modules and npm modules that use them in your React Native app.
If your project has no non-React-Native dependencies, you don't need this module, and you should just check out './shims.js' for the core node modules to use individually.
However, with bigger projects that don't reimplement every wheel from scratch, somewhere in your dependency tree, something uses a core node module. I found myself building this because in my React Native app, I wanted to use bitcoinjs-lib, levelup, bittorrent-dht, and lots of fun crypto. If that sounds like you, keep reading.
rn-nodeify --install
installs shims for core node modules, see './shims.js' for the current mappings. It recurses down node_modules and modifies all the package.json's in there to add/update the browser and react-native fields. It sounds scary because it is. However, it does work.
rn-nodeify --hack
Now that you're scared, I should also mention that there are some package-specific hacks (see './pkg-hacks.js'), for when the React Native packager choked on something that Webpack and Browserify swallowed.
If you're looking for a saner approach, check out ReactNativify. I haven't tested it myself, but I think philikon will be happy to help.
rn-nodeify <options>
--install install node core shims (default: install all), fix the "browser"
and "react-native" fields in the package.json's of dependencies
--hack hack individual packages that are known to make the React Native packager choke
# install all shims and run package-specific hacks
rn-nodeify --install --hack
# install specific shims
rn-nodeify --install "fs,dgram,process,path,console"
# install specific shims and hack
rn-nodeify --install "fs,dgram,process,path,console" --hack
It is recommended to add this command to the "postinstall" script in your project's package.json
"scripts": {
"start": "node node_modules/react-native/local-cli/cli.js start",
"postinstall": "rn-nodeify --install fs,dgram,process,path,console --hack"
}
rn-nodeify will create a shim.js file in your project root directory. The first line in index.ios.js / index.android.js should be to import it (NOT require it!)
import './shim'
Some shims may require linking libraries, be sure to run react-native link after installing new shims if you run into problems.
copied from react-native-crypto
npm i --save react-native-crypto
# install peer deps
npm i --save react-native-randombytes
react-native link react-native-randombytes
# install latest rn-nodeify
npm i --save-dev mvayngrib/rn-nodeify
# install node core shims and recursively hack package.json files
# in ./node_modules to add/update the "browser"/"react-native" field with relevant mappings
./node_modules/.bin/rn-nodeify --hack --install
rn-nodeify will create a shim.js in the project root directory// index.ios.js or index.android.js
// make sure you use `import` and not `require`!
import './shim.js'
// ...the rest of your code
import crypto from 'crypto'
// use crypto
console.log(crypto.randomBytes(32).toString('hex'))
npm link.rm node_modules/*/.babelrc)npm run postinstall)rm -fr $TMPDIR/react-*)npm to install shims. PRs are welcome to make it compatible with yarnnpm@3. npm@5 has some issues that cause node_modules to disappear. See:
FAQs
Run after npm install and you can use node core modules and npm modules that use them in your React Native app.
We found that rn-nodeify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.