
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@accessible/tabbable
Advanced tools
A function that returns an array of all tabbable DOM nodes within a containing node.
npm i @accessible/tabbable
Returns an array of all* tabbable DOM nodes within a containing node. (* "all" has some necessary caveats, which you'll learn about by reading below.)
The following are considered tabbable:
<button>
<input>
<select>
<textarea>
<a>
with href
or xlink:href
attributes<audio>
and <videos>
with controls
attributes[contenteditable]
elementstabindex
Any of the above will not be considered tabbable, though, if any of the following are also true about it:
tabindex
disabled
display: none
or visibility: hidden
<input type="radio">
and a different radio in its group is checked
If you think a node should be included in your array of tabbables but it's not, all you need to do is add tabindex="0"
to deliberately include it. (Or if it is in your array but you don't want it, you can add tabindex="-1"
to deliberately exclude it.) This will also result in more consistent cross-browser behavior. For information about why your special node might not be included, see "More details", below.
tabbable(rootNode: HTMLElement, includeRootNode: boolean = false): HTMLElement[]
Returns an array of ordered tabbable node within the rootNode
.
Summary of ordering principles:
tabindex
attributes (1 or higher), ordered by ascending tabindex
and source order.tabindex
and any element that by default receives focus (listed above) and does not have a positive tabindex
set, in source order.<object>
and <iframe>
— so this means some elements that you can tab to in some browsers will be left out of the results. (To learn more about that stupid inconsistency, see this amazing table). To provide better consistency across browsers and ensure the elements you want in your tabbables list show up there, try adding tabindex="0"
to edge-case elements that Tabbable ignores.<iframe>
, <embed>
, <object>
, <summary>
, and <svg>
is inconsistent across browsers, so if you need an accurate read on one of these elements you should try giving it a tabindex
. (You'll also need to pay attention to the focusable
attribute on SVGs in IE & Edge.) But you also might not be able to get an accurate read — so you should avoid relying on it.checked
one in each group (and that is what you should usually do anyway). If there is no checked
radio in the radio group, all of the radios will be considered tabbable. (Some browsers do this, otherwise don't — there's not consistency.)<a>
elements by default: you have to change a setting to get the standard behavior. Tabbable does not know whether you've changed that setting or not, so it will include <a>
elements in its list.The creator is looking for a new maintainer and @accessibile
packages don't need some of the features
in the original, so I can make a smaller package with TypeScript types by forking :P
This library is forked from tabbable
MIT
FAQs
A function that returns an array of all tabbable DOM nodes within a containing node.
We found that @accessible/tabbable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.