
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
use-sidecar
Advanced tools
UI/Effects code splitting pattern - read more.
Sidecar pattern is clear:
sidecars on server.sidecars prior main render.Thus - no usage tracking, and literally no SSR. It's just skipped.
sidecar(robin) - not UI component, which may carry effects for a paired UI component.UI(batman) - UI component, which interactivity is moved to a sidecar.a package exposes 3 entry points using a nested package.json format:
combination, and lets hope tree shaking will save youUI, with only UI partsidecar, with all the logic
UI+sidecar===combination. The size ofUI+sidecarmight a bit bigger than size of theircombination. Use size-limit to control their size independently.
package uses a medium to talk with own sidecar, breaking explicit dependency.
if package depends on another sidecar package:
medium, thus able to export multiple sidecars via one export.final consumer uses sidecar or useSidecar to combine pieces together.
UI components might use/import any other UI componentssidecar could use/import any other sidecarThat would form two different code branches, you may load separately - UI first, and effect sidecar later. That also leads to a obvious consequence - one sidecar may export all sidecars.
to decouple sidecars from module exports, and be able to pick "the right" one at any point
you have to use exportSidecar(medium, component) to export it, and use the same medium to import it back.
this limitation is for libraries only, as long as in the usercode you might dynamically import whatever and whenever you want.
useMedium is always async - action would be executed in a next tick, or on the logic load.
sidecar is always async - is does not matter have you loaded logic or not - component would be
rendered at least in the next tick.
except
medium.read, which synchronously read the data from a medium, andmedium.assingSyncMediumwhich changesuseMediumto be sync.
use in UI side, and assign from side-car. All effects would be executed.const medium = createMedium(defaultValue);
const cancelCb = medium.useMedium(someData);
// like
useEffect(() => medium.useMedium(someData), []);
medium.assignMedium(someDataProcessor)
// createSidecarMedium is a helper for createMedium to create a "sidecar" symbol
const effectCar = createSidecarMedium();
! For consistence
useMediumis async - sidecar load status should not affect function behavior, thus effect would be always executed at least in the "next tick". You may alter this behavior by usingmedium.assingSyncMedium.
component inside medium and return external wrappersidecarimport {effectCar} from './medium';
import {EffectComponent} from './Effect';
// !!! - to prevent Effect from being imported
// `effectCar` medium __have__ to be defined in another file
// const effectCar = createSidecarMedium();
export default exportSidecar(effectCar, EffectComponent);
Suspense, might provide error failback.import {sidecar} from "use-sidecar";
const Sidecar = sidecar(() => import('./sidecar'), <span>on fail</span>);
<>
<Sidecar />
<UI />
</>
exportedSidecarWould require additional prop to be set - <Sidecar sideCar={effectCar} />
sideCar using provided importer which shall follow React.lazy APIimport {useSidecar} from 'use-sidecar';
const [Car, error] = useSidecar(() => import('./sideCar'));
return (
<>
{Car ? <Car {...props} /> : null}
<UIComponent {...props}>
</>
);
exportedSideCarYou have to specify effect medium to read data from, as long as export itself is empty.
import {useSidecar} from 'use-sidecar';
/* medium.js: */ export const effectCar = useMedium({});
/* sideCar.js: */export default exportSidecar(effectCar, EffectComponent);
const [Car, error] = useSidecar(() => import('./sideCar'), effectCar);
return (
<>
{Car ? <Car {...props} /> : null}
<UIComponent {...props}>
</>
);
defaults and use them until sidecar is loaded letting you code split (non visual) render-prop componentimport {renderCar, sidecar} from "use-sidecar";
const RenderCar = renderCar(
// will move side car to a side channel
sidecar(() => import('react-powerplug').then(imports => imports.Value)),
// default render props
[{value: 0}]
);
<RenderCar>
{({value}) => <span>{value}</span>}
</RenderCar>
setConfig({
onError, // sets default error handler
});
MIT
react-use is a comprehensive collection of essential hooks for React, which also includes hooks for managing side effects similar to use-sidecar. While react-use provides a broader range of hooks, use-sidecar focuses specifically on sidecar pattern implementations.
effector-react offers a robust solution for state management and side effects in React applications. It differs from use-sidecar by providing a more integrated approach to state management along with side effects, whereas use-sidecar focuses solely on side effect isolation.
FAQs
Sidecar code splitting utils
The npm package use-sidecar receives a total of 11,364,508 weekly downloads. As such, use-sidecar popularity was classified as popular.
We found that use-sidecar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.