
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@autots/sticky
Advanced tools
a sticky lib to simulate stickily positioned element.
sticky firstlytopUsing npm:
$ npm install @autots/sticky -S
Using yarn:
$ yarn add @autots/sticky
<section id="demo">
<div class="child"></div>
</section>
Note: When the host browser doesn't support css position: sticky, the lib will fall back to use scroll event on window object, and set some css properties to his fisrtElementChild.
import Sticky from '@autots/sticky';
// 1. The simplest way
new Sticky('#demo');
// 2. use config
new Sticky('#demo', {
top: 10,
zIndex: 100
})
<script src="dist/sticky.min.js"></script>
<script>
var stickyDemo = new AutoTs.Sticky(el, config);
</script>
| Name | Type | Default | Optional | Description |
|---|---|---|---|---|
| mode | 'sticky' or 'affix' | 'sticky' | true | normal affix(fixed) mode or new sticky feature | |
| scrollRefer | string | HTMLElement | Document | Window | window | true | scroll container |
| offsetParent | string | null | true | offset parent el | |
| top | number | 0 | true | CSS top (px) property |
| style | object | {} | true | CSS property |
| holderStyle | object | {} | true | CSS property for the Target Placeholder Element |
| throttle | boolean | false | true | throttle feature when use scroll event(assigned when encounter special cases) |
scrollRefer & offsetParent must have a non-static position.
directionFAQs
a sticky lib to simulate stickily positioned element
We found that @autots/sticky demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.