
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@atomicjolt/lti-client
Advanced tools
This is a collection of Javascript used by Atomic Jolt to assist in handling a LTI launch.
`npm i @atomicjolt/lti-client`
For an example of how to use this library see https://github.com/atomicjolt/atomic-lti-worker
The application code using this library must implement the LTI Launch in 3 phases, providing the server side code for each phase and returning and html response for each phase. Phases 1 and 3 will include a call to the client side javacript contained in this library. See the 1Edtech working group documentation for more information about the LTI standard: https://www.imsglobal.org/activity/learning-tools-interoperability
Open ID Connect initialization
During this phase respond to the OIDC initialization request, attempt to write a state cookie and return and html page with a call to initOIDCLaunch
import { initOIDCLaunch } from '@atomicjolt/lti-client';
Redirect Server side validate the redirect and then return an HTML page capable of redirecting to the final LTI launch
Handle the LTI launch.
Validate the request including checking the nonce server side. Check for a valid state cookie and then return an HTML page with a script that calls LtiLaunch from this library.
import { ltiLaunch } from '@atomicjolt/lti-client';
Report any issues using Github
Build package:
npm run build
Publish package:
npm publish --access public
MIT This code is released as open source without any support or warranty. It is used by Atomic Jolt internally and is released in case someone finds it useful.
FAQs
Client Javascript libraries to handle LTI.
The npm package @atomicjolt/lti-client receives a total of 75 weekly downloads. As such, @atomicjolt/lti-client popularity was classified as not popular.
We found that @atomicjolt/lti-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.