
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@braneproject/worker-dom
Advanced tools
A facsimile of a modern DOM implementation intended to run in a Web Worker.
An in-progress implementation of the DOM API intended to run within a Web Worker.
Purpose: Move complexity of intermediate work related to DOM mutations to a background thread, sending only the necessary manipulations to a foreground thread.
Use Cases:
For more information, visit our blog post announcing WorkerDOM or checkout the slides from the announcement at JSConf US.
npm install @ampproject/worker-dom
WorkerDOM comes in two flavours, a global variant and a module variant. It is possible to include the WorkerDOM main thread code within your document directly or via a bundler. Here's how you might do so directly:
<script src="path/to/workerdom/dist/main.mjs" type="module"></script>
<script src="path/to/workerdom/dist/main.js" nomodule defer></script>
WorkerDOM allows us to upgrade a specific section of the document to be driven by a worker. For example, imagine a div
node in the page like so:
<div src="hello-world.js" id="upgrade-me"></div>
To upgrade this node using the module version of the code, we can directly import upgradeElement
and use it like this:
<script type="module">
import {upgradeElement} from './dist/main.mjs';
upgradeElement(document.getElementById('upgrade-me'), './dist/worker/worker.mjs');
</script>
The nomodule format exposes the global MainThread
, and could upgrade the div
in the following way:
<script nomodule async=false defer>
document.addEventListener('DOMContentLoaded', function() {
MainThread.upgradeElement(document.getElementById('upgrade-me'), './dist/worker/worker.js');
}, false);
</script>
amp-script
WorkerDOM has a special output variant that supplies additional hooks for safety features e.g. HTML sanitization. This variant is distributed under the amp folder for main and worker thread binaries:
amp/main.mjs
amp/worker/worker.mjs
This output assumes the consumer will compile this distributed JavaScript to ensure it works with older user-agent
s.
WorkerDOM also has an output variant that includes additional debugging messages. This variant is distributed in the debug folder.
debug/main.mjs
debug/main.js
debug/worker/worker.mjs
debug/worker/worker.js
After cloning the repository, you can try out the debug demos with the following.
npm run demo
This script will build the current version of WorkerDOM and start up a local webserver.
Currently, most DOM elements and their properties are supported. DOM query APIs like querySelector
have partial support. Browser APIs like History are not implemented yet. Please see the API support matrix here.
In general we support the latest two versions of major browsers like Chrome, Firefox, Edge, Safari, Opera and UC Browser. We support desktop, phone, tablet and the web view version of these respective browsers.
Beyond that, we aim for very wide browser support and we accept fixes for all browsers with market share greater than 1 percent.
In particular, we try to maintain "it might not be perfect but isn't broken"-support for IE 11, iOS 8, the Android 4.0 system browser and Chrome 41.
Local development of WorkerDOM assumes the following:
npm
or yarn
Each release includes a log of changes with the newly released version. You can find the log here: https://github.com/ampproject/worker-dom/releases
The AMP Project accepts responsible security disclosures through the Google Application Security program.
The AMP Project strives for a positive and growing project community that provides a safe environment for everyone. All members, committers and volunteers in the community are required to act according to the code of conduct.
worker-dom is licensed under the Apache License, Version 2.0.
FAQs
A facsimile of a modern DOM implementation intended to run in a Web Worker.
We found that @braneproject/worker-dom demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.