
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@polingo/web
Advanced tools
Browser-oriented loader and cache for the Polingo translation engine.
@polingo/web bundles a Fetch-based loader and a resilient localStorage cache so you can use @polingo/core inside traditional SPAs, server-rendered apps that hydrate on the client, or edge runtimes with a compatible fetch implementation.
/locales/<locale>/<domain>.json).buildUrl, fetch, and RequestInit for CDNs or authenticated endpoints.localStorage is unavailable.@polingo/core to provide synchronous translations after the initial preload.npm install @polingo/core @polingo/web
# or
pnpm add @polingo/core @polingo/web
# or
yarn add @polingo/core @polingo/web
import { createPolingo } from '@polingo/web';
const polingo = await createPolingo({
locale: 'en',
locales: ['en', 'es'],
loader: { baseUrl: '/i18n' }, // fetches /i18n/en/messages.json, etc.
cache: true,
cacheOptions: { prefix: 'my-app', ttlMs: 86_400_000 }, // 24h
});
polingo.t('Welcome');
polingo.tn('{n} item', '{n} items', 3, { n: 3 });
WebLoader powers createPolingo under the hood. You can customise it through the loader key or instantiate it yourself.
interface WebLoaderOptions {
baseUrl?: string; // defaults to '/locales'
buildUrl?: (locale: string, domain: string) => string; // overrides baseUrl
fetch?: typeof fetch; // provide for older browsers, React Native, SSR, or tests
requestInit?: RequestInit; // extra options (credentials, headers, cache directives, ...)
transformResponse?: (payload: unknown) => TranslationCatalog; // adapt bespoke formats
}
Example: streaming from a CDN with authentication.
const polingo = await createPolingo({
locale: 'en',
locales: ['en', 'fr'],
loader: {
buildUrl: (locale, domain) => `https://cdn.example.com/static/i18n/${locale}/${domain}.json`,
requestInit: {
credentials: 'include',
cache: 'reload',
},
},
});
createPolingo enables caching by default (cache: true). Behind the scenes it uses LocalStorageCache, which offers:
prefix to namespace entries (defaults to polingo).ttlMs to automatically expire catalogs (unset means persist indefinitely).storage to swap the backing store (useful for testing).When localStorage is unavailable (SSR, Safari private mode, locked-down WebViews), the cache drops down to an in-memory MemoryCache so translations continue to work, albeit without persistence between reloads.
Disable caching with cache: false if your catalogs are short-lived or you control caching via HTTP headers.
await polingo.setLocale(locale).createPolingo only on the client if localStorage is required.Translator with WebLoader and NoCache, then hydrate with createPolingo on the client for persistence.fetch implementation (e.g., from undici, cross-fetch, or the platform) through loader.fetch.localStorage.By default the loader expects JSON that matches TranslationCatalog from @polingo/core:
{
"charset": "utf-8",
"headers": {
"Plural-Forms": "nplurals=2; plural=(n != 1);"
},
"translations": {
"": {
"Welcome": {
"msgid": "Welcome",
"msgstr": "Bienvenido"
}
},
"menu": {
"File": {
"msgid": "File",
"msgctxt": "menu",
"msgstr": "Archivo"
}
}
}
}
If your backend returns a different shape, use transformResponse to convert it before it reaches the translator.
ttlMs to refresh them periodically.createPolingo errors during startup and surfacing a user-friendly fallback.messages, errors, etc.) clients expect—catalog URLs are derived from the domain.@polingo/core – translation runtime (Translator, caches, helpers).@polingo/node – filesystem loader, middleware, and watcher for Node.js.@polingo/react – React hooks, context provider, and Trans component.@polingo/cli – command line tooling for extraction, compilation, and validation.MIT © Reinier Hernández Avila
FAQs
Browser adapter for Polingo with fetch loader and localStorage caching
We found that @polingo/web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.