
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@uploadcare/react-uploader
Advanced tools
Website • Docs • Blog • Discord • Twitter
Welcome to the Uploadcare React Uploader documentation! This documentation provides guidance on how to use the Uploadcare React Uploader in your projects, along with details about its features, installation process, usage examples, customization options, event handling, and security considerations.
npm install @uploadcare/react-uploader
import { FileUploaderRegular } from "@uploadcare/react-uploader";
import "@uploadcare/react-uploader/core.css";
<FileUploaderRegular pubkey="YOUR_PUBLIC_KEY"/>;
An easy way to connect React Uploader to your project and utilize the available API props. We provide a full set of props that are used in File Uploader. For review we suggest you to look at the documentation.
For convenience, we provide the ability to access the File Uploader API using apiRef.
You can see what methods are available in apiRef in the documentation.
import React, {useRef, useEffect} from "react";
import {
FileUploaderRegular,
UploadCtxProvider
} from "@uploadcare/react-uploader";
import "@uploadcare/react-uploader/core.css";
const Example = () => {
const uploaderRef = useRef<UploadCtxProvider | null>(null);
<FileUploaderRegular apiRef={uploaderRef} pubkey="YOUR_PUBLIC_KEY"/>;
}
Events in React Uploader are the same as in File Uploader, see the documentation. The principle of converting events from blocks to React Uploader:
on.camelCase.import { FileUploaderRegular } from "@uploadcare/react-uploader";
import "@uploadcare/react-uploader/core.css";
<FileUploaderRegular
pubkey="YOUR_PUBLIC_KEY"
onModalOpen={() => {
console.log('modal-open')
}}
/>
You can customize the appearance of the React Uploader by using the className prop, which lets you apply custom CSS classes to the FileUploader wrapper, including the Regular, Minimal, and Inline variations.
However, if you need to assign a class specifically to the uploader file. Use the classNameUploader prop.
import { FileUploaderRegular } from "@uploadcare/react-uploader";
import "@uploadcare/react-uploader/core.css";
<FileUploaderRegular
classNameUploader="uc-dark"
className="fileUploaderWrapper"
pubkey="YOUR_PUBLIC_KEY"
/>;
.fileUploaderWrapper uc-file-uploader-regular {
}
File Uploader does not support Server-side Rendering (SSR), we have a special import for nextjs that already has SSR disabled.
You will need to import with import @uploadcare/react-uploader/next
'use client'
import { FileUploaderRegular } from "@uploadcare/react-uploader/next";
import "@uploadcare/react-uploader/core.css";
function App() {
return <FileUploaderRegular pubkey="YOUR_PUBLIC_KEY" />
};
If you think you ran into something in Uploadcare libraries that might have security implications, please hit us up at bugbounty@uploadcare.com or Hackerone.
We'll contact you personally in a short time to fix an issue through co-op and prior to any public disclosure.
Issues and PRs are welcome. You can provide your feedback or drop us a support request at hello@uploadcare.com.
FAQs
React component for file uploads using Uploadcare
The npm package @uploadcare/react-uploader receives a total of 10,243 weekly downloads. As such, @uploadcare/react-uploader popularity was classified as popular.
We found that @uploadcare/react-uploader demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.