
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
signal-components
Advanced tools
**Signal-components is the easy way to integrate real reactivity into your React app.**
Signal-components is the easy way to integrate real reactivity into your React app.
React is a great library for building user interfaces, but it lacks a built-in reactivity system. They chose to use rerenders as a way to update the UI, which is not always the best solution.
Signal-like reactivity systems are a great way to solve this problem. They don't trigger rerenders when the state changes, but instead, they trigger only the components that depend on the changed state. But this way is not ideal too. Any reactivity system designed for describing the signals globally, and it's hard to integrate them into existing React app.
Signal-components act as the glue between your hook-based components and the reactivity system.
import {declareComponent} from 'signal-components';
type Props = {
x: number;
y: number;
};
const Component = declareComponent<Props>(({x, y}, options) => {
// ^
// Inside props
// x and y are Atom<number> here
const z = atom(ctx => ctx.spy(x) + ctx.spy(y));
// init phase
return ({spy}) => {
// render phase
return <div>{spy(z)}</div>
}
});
<Component x={1} y={atom(1)} /> // <- Outside props
You have access to the functions in the render phase:
Props with prefix on[A-Z] are called "Stable functions" in signal-components.
That means you receive the same function instance from the insideProps. Doesn't matter how many times the component is rendered and what you pass to the prop: different functions or the undefined value.
Stable functions benefits demo: https://codesandbox.io/p/sandbox/signal-components-stable-functions-7d4m34
Inside props is the Proxy object. That's the reason because we have one significant limitation: you cannot get rest of the inside props.
const Component = declareComponent<Props>((insideProps, options) => {
const {...rest} = insideProps; // <- Error here. Use `rest` operator instead
// ...
});
Defaults operator is a way to provide default values for the internal props.
const Component = declareComponent<Props>((insideProps, options) => {
const {x = atom(1)} = insideProps; // <- Error here because x is Atom<undefined>. Not undefined
const {x} = defaults(insideProps, {x: 1}); // <- Ok way
// ...
});
Rest operator is a way to get the rest of the internal props. See Insights for more information.
const Component = declareComponent<Props>((insideProps, options) => {
const {x, ...rest} = insideProps; // <- Error here. Use `rest` operator instead
const {x} = insideProps;
const restProps = rest(insideProps, ['x']); // <- Ok way
// ...
});
getAllPropsSignal is a way to get all props as a signal. It's useful when you start to rewrite your component.
const Component = declareComponent<Props>((insideProps, options) => {
return ({spy}) => {
const unwrappedProps = spy(getAllPropsSignal(insideProps));
//...
};
});
We recommend don't use this operator in your code, but it is useful for refactoring purposes
FAQs
**Signal-components is the easy way to integrate real reactivity into your React app.**
The npm package signal-components receives a total of 25 weekly downloads. As such, signal-components popularity was classified as not popular.
We found that signal-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.