
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@borvik/dialog-polyfill
Advanced tools
This is a fork of https://github.com/GoogleChrome/dialog-polyfill. Because of the polyfill nature, I'm fairly sure (but not certain) the feature I wanted would not be added (or merged back - and rightly so) as it would go beyond the polyfill it was designed to be.
Essentially I wanted to transform an ordinary <div> into a dialog so I could avoid the <dialog> stacking context and have a element with a z-index greater than the dialog show on top of it (think custom select/context menu or other dropdown).
dialog-polyfill.js is a polyfill for <dialog> and <form method="dialog">.
Check out some demos!
<dialog> is an element for a popup box in a web page, including a modal option which will make the rest of the page inert during use.
This could be useful to block a user's interaction until they give you a response, or to confirm an action.
See the HTML spec.
You may optionally install via NPM -
$ npm install dialog-polyfill
There are several ways that to include the dialog polyfill:
dist/dialog-polyfill.js script directly in your HTML, which exposes a global dialogPolyfill function.import (es modules)require (commonjs/node)// direct import (script module, deno)
import dialogPolyfill from './node_modules/dialog-polyfill/dist/dialog-polyfill.esm.js';
// *OR*
// modern es modules with rollup/webpack bundlers, and node via esm module
import dialogPolyfill from 'dialog-polyfill'
// *OR*
// traditional commonjs/node and browserify bundler
const dialogPolyfill = require('dialog-polyfill')
This polyfill works on modern versions of all major browsers. It also supports IE9 and above. It can work when used inside Shadow DOM, but it's not recommended.
<head> of your document, and the JS anywhere before referencing dialogPolyfill.dialogPolyfill.registerDialog(), passing it one node at a time. This polyfill won't replace native support.<dialog> elements!<head>
<link rel="stylesheet" type="text/css" href="dist/dialog-polyfill.css" />
</head>
<body>
<dialog>
I'm a dialog!
<form method="dialog">
<input type="submit" value="Close" />
</form>
</dialog>
<script src="dist/dialog-polyfill.js"></script>
<script>
var dialog = document.querySelector('dialog');
dialogPolyfill.registerDialog(dialog);
// Now dialog always acts like a native <dialog>.
dialog.showModal();
</script>
</body>
In native <dialog>, the backdrop is a pseudo-element.
When using the polyfill, the backdrop will be an adjacent element:
dialog::backdrop { /* native */
background-color: green;
}
dialog + .backdrop { /* polyfill */
background-color: green;
}
In the polyfill, modal dialogs have limitations-
The major limitation of the polyfill is that dialogs should not have parents that create a stacking context.
The easiest way to solve this is to move your <dialog> element to be a child of <body>.
If this isn't possible you may still be able to use the dialog. However, you may want to resolve it for two major reasons-
To position a dialog in the center (regardless of user scroll position or stacking context), you can specify the following CSS-
dialog {
position: fixed;
top: 50%;
transform: translate(0, -50%);
}
This is also provided as a helper CSS class in the polyfill CSS, .fixed.
You can apply by using HTML like <dialog class="fixed">.
The WAI-ARIA doc suggests returning focus to the previously focused element after a modal dialog is closed.
However, this is not part of the dialog spec itself.
See this snippet to add this, even to the native dialog.
FAQs
Polyfill for the dialog element
We found that @borvik/dialog-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.