
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@edux-design/forms
Advanced tools
React form primitives that share a common context so every label, control, and validation message stays connected and accessible. The package powers the `Field`, `Label`, `Input`, `Textarea`, `Checkbox`, `Radio`, `Switch`, and `Feedback` components used a
React form primitives that share a common context so every label, control, and validation message stays connected and accessible. The package powers the Field, Label, Input, Textarea, Checkbox, Radio, Switch, and Feedback components used across the Edux design system.
FieldProvider wires htmlFor, aria-describedby, and live regions automatically.<Field> and re-export Field.Feedback for colocated messaging.cx helper plus the Edux tokens for borders, colors, spacing, and focus rings.npm install @edux-design/forms @edux-design/utils @edux-design/icons
# or
pnpm add @edux-design/forms @edux-design/utils @edux-design/icons
Peer dependencies:
react ^19.1.0react-dom ^19.1.0After installing, ensure your build pipeline can consume both ESM and CJS outputs (generated via tsup). The published bundle exposes /dist/index.{js,mjs} plus type declarations.
import { Field, Label, Input, Textarea, Checkbox, Radio } from "@edux-design/forms";
export function SignupForm() {
return (
<form className="flex flex-col gap-8 w-full max-w-md">
<Field>
<Label hint="required" description="We’ll only email account alerts.">
Email address
</Label>
<Input
type="email"
placeholder="you@example.com"
variant="primary"
clearable
/>
<Field.Feedback tone="error">
This email is already registered.
</Field.Feedback>
</Field>
<Field>
<Label hint="optional">Bio</Label>
<Textarea rows={5} placeholder="Tell us about yourself…" />
</Field>
<Field>
<Label>Contact me</Label>
<Radio />
</Field>
<Field>
<Label hint="required">Terms</Label>
<Checkbox aria-label="Agree to the terms and conditions" />
<Field.Feedback tone="corrective">
Agreeing is required before continuing.
</Field.Feedback>
</Field>
</form>
);
}
Every Field instance mounts a internal context. Label, Input, Textarea, Radio, and Field.Feedback consume that context so they stay synchronized even if rendered in separate components.
<Field>flex, gap-8) and context wiring.Label, a control (Input, Textarea, Radio), and optional Field.Feedback.orientation="horizontal" when you need inline layouts (e.g., Switch + label) without affecting other form groups.justify="between" with orientation="horizontal" to align left labels and right controls across a column.Field.Feedback for ergonomic composition.<Label>htmlFor.hint="required" | "optional" and a description prop rendered beneath the main label.hidden to visually hide the label while keeping it accessible.<Input><input> props and forwards refs.primary, error, corrective, success, inactive.startIcon, endIcon, and clearable button (uses the Close icon).clearable is set, clicking the clear button dispatches onChange with an empty value, so controlled inputs update seamlessly.aria-invalid, aria-disabled, and disables itself for the inactive variant.<Textarea>rows, startIcon, endIcon, clearable, and the same variants.resize-y by default; pass inline styles to opt into both-axis resizing.<Radio>Field context.<Checkbox>indeterminate appearance for tri-state flows.aria-describedby references with the wrapping Field, so helper text and validation copy are announced.<Label> for field titles; pass aria-label or wrap inline helper text next to the component when you need per-option copy.<Switch>primary, success, corrective, error, inactive) so validation states stay consistent.Field context to automatically sync id, focus management, and aria-describedby strings built from registered feedback messages.variant="inactive" and exposes hover, focus, pressed, and checked states for every other variant.<Field.Feedback>info, success, warning, error, corrective.id with the parent Field, so any controls automatically receive aria-describedby.tone="error" switches to role="alert" / aria-live="assertive"; other tones stay aria-live="polite".FieldProvider assigns a unique labelHTMLForId; the same ID drives <label htmlFor> and the child control’s id.Field.Feedback registers/unregisters its identifier so inputs build the aria-describedby string automatically, even if multiple feedback blocks mount.role="alert", while neutral/success tones fall back to polite announcements.focus:shadow-focus utility, ensuring visible focus outlines without extra work.To enforce the contract, hooks throw if you render any primitive outside <Field>, making misconfigurations obvious during development.
Variants map directly to semantic tokens defined in @edux-design/design-tokens and consumed via Tailwind utility classes:
| Variant | Border / Background intent |
|---|---|
primary | Default border; highlights on hover/focus with primary color. |
error | Danger border + subtle danger background for immediate errors. |
corrective | Soft highlight for “nudge” messages without blocking input. |
success | Success border for confirmed entries. |
inactive | Muted border/background, disables the control automatically. |
Apply variants per control to reflect validation state. Combine with Field.Feedback to reinforce messaging.
pnpm build (or npm run build) bundles the package via tsup into dist/.pnpm dev starts tsup in watch mode.pnpm lint and pnpm check-types keep code quality high.Stories live under src/demos/*.stories.jsx; use them as references for new component states and to manually verify visual behavior.
Radio.jsx).Close glyph for all tones; alternative glyphs per tone may improve clarity.value for controlled usage—add tests to prevent regressions.Contributions should follow the existing Tailwind utility conventions and rely on the shared tokens/utilities package to stay consistent with the broader system.
FAQs
React form primitives that share a common context so every label, control, and validation message stays connected and accessible. The package powers the `Field`, `Label`, `Input`, `Textarea`, `Checkbox`, `Radio`, `Switch`, and `Feedback` components used a
We found that @edux-design/forms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.