
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@choppu/shelljs-web-hid
Advanced tools
Keycard Shell WebHID implementation of the communication layer
ShellJS Web HID is an implementation of the communication layer.
npm install @choppu/shelljs-web-hid
import TransportWebHID from "shelljs-web-hid";
...
let transport: any;
transport = await TransportWebHID.create();
...
You can check a demo at Shell Web HID Example Page.
WebUSB is currently only supported on Google Chrome / Chromium DEV version and by explicitly enabling chrome://flags/#enable-experimental-web-platform-features
Extends Transport
WebHID Transport implementation
device HIDDeviceRelease the transport device
Returns Promise<void>
Exchange with the device using APDU protocol.
apdu BufferReturns Promise<Buffer> a promise of apdu response
Check if WebUSB transport is supported.
List the WebUSB devices that was previously authorized by the user.
Actively listen to WebUSB devices and emit ONE device that was either accepted before, if not it will trigger the native permission UI.
Important: it must be called in the context of a UI click!
observer Observer<DescriptorEvent<HIDDevice>>Returns Subscription
Similar to create() except it will always display the device permission (even if some devices are already accepted).
Similar to create() except it will never display the device permission (it returns a Promise<?Transport>, null if it fails to find a device).
Create a Shell transport with a HIDDevice
device HIDDeviceFAQs
Keycard Shell WebHID implementation of the communication layer
We found that @choppu/shelljs-web-hid demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.