Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@area17/a17-lazyload
Advanced tools
A straight forward lazy loader using IntersectionObserver
if available and if not, it uses a requestAnimationFrame
loop if available. If neither are available it does nothing.
When a watched element is in the view port it swaps data-src/data-srcset
on img
, source
and iframe
to src/srcset
. It also adds a load listener and removes the data-
attribute on load to allow you to hook styles up to the two different states.
If data-srcset
to srcset
and typeof picturefill
, attempts to run picturefill()
on the element.
When it runs out of elements to watch, the loop ends.
More detailed instructions on usage are at: http://lazyload.dev.area17.com/
<script src="path/to/a17-lazyload.min.js"></script>
<script>
lazyload();
</script>
Also available via NPM:
npm install @area17/a17-lazyload
import lazyload from '@area17/a17-lazyload';
lazyload();
If you find a bug in a17-lazyload, please add it to the issue tracker or fork it, fix it and submit a pull request for it (👍).
The development script is dist/a17-lazyload.js
. Tabs are 2 spaces, functions are commented, variables are camel case and its preferred that its easier to read than outright file size being the smallest possible.
Make sure to include a minified version inside of dist
by running: npm run minify
(you'll need to npm run install
to install terser
). The minified version is added to the git repository for users who aren't using build tools.
IE10+ because of the use of requestAnimationFrame
if no IntersectionObserver
.
loading="lazy"
support: https://addyosmani.com/blog/lazy-loading/MutationObserver
to check for dynamically added elements to check.FAQs
A simple, tiny, no dependency, lazy loader - by A17
The npm package @area17/a17-lazyload receives a total of 12 weekly downloads. As such, @area17/a17-lazyload popularity was classified as not popular.
We found that @area17/a17-lazyload demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.