
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@coveo/atomic-legacy
Advanced tools
Package used internally by @coveo/atomic for components using legacy technologies (e.g., Stencil). This package is not intended for public use.
⚠️ Internal Package: This package is used internally by
@coveo/atomicfor components using legacy Stencil technologies. It should not be used directly in your projects.
@coveo/atomic-legacy provides legacy Stencil-based components that are consumed by the main @coveo/atomic package. This package exists to support backward compatibility during the migration from Stencil to Lit components.
This package is part of Coveo's ongoing modernization effort to migrate from Stencil to Lit for better performance, smaller bundle sizes, and improved maintainability. Components in this package use the legacy Stencil architecture and are gradually being migrated to the main @coveo/atomic package as Lit components.
An internal component used to render individual search box suggestions. It handles rendering of suggestion content that can be either Stencil VNodes or native DOM Elements, providing compatibility between legacy Stencil components and modern Lit implementations.
Key features:
The package exposes a single entry point:
@coveo/atomic-legacy/atomic-suggestion-renderer: Direct access to the suggestion renderer component with types and implementationThis package is consumed automatically by @coveo/atomic and should not be installed or imported directly in application code.
Do not use:
// ❌ Don't import from atomic-legacy in your projects
import { AtomicSuggestionRenderer } from '@coveo/atomic-legacy';
Instead, use:
// ✅ Use the main @coveo/atomic package
import { defineCustomElements } from '@coveo/atomic/loader';
From the monorepo root:
pnpm turbo run build --filter=@coveo/atomic-legacy
Components in this package are candidates for migration to Lit. If you're contributing to the migration effort:
.github/prompts/@coveo/atomic - Main Atomic web components library@coveo/headless - Headless search library powering AtomicApache-2.0. See LICENSE for details.
FAQs
Package used internally by @coveo/atomic for components using legacy technologies (e.g., Stencil). This package is not intended for public use.
The npm package @coveo/atomic-legacy receives a total of 221 weekly downloads. As such, @coveo/atomic-legacy popularity was classified as not popular.
We found that @coveo/atomic-legacy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.