
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@doars/doars-view
Advanced tools
Doars plugin that adds a view directive for reacting to intersection changes.
Plugin that adds a view directive for reacting to intersection changes.
Install the package from NPM, then import and enable the library in your build.
npm i @doars/doars @doars/doars-view
// Import libraries.
import Doars from "@doars/doars";
import DoarsView from "@doars/doars-view";
// Setup a library instance.
const doars = new Doars();
// Setup the plugin.
const doarsView = new DoarsView(doars /*, options */);
// Enable library.
doars.enable();
Add the UMD build to the page from for example the jsDelivr CDN and enable the library.
<!-- Import library. -->
<script src="https://cdn.jsdelivr.net/npm/@doars/doars@1/dst/doars.umd.js"></script>
<script src="https://cdn.jsdelivr.net/npm/@doars/doars-view@1/dst/doars-view.umd.js"></script>
<script>
document.addEventListener('DOMContentLoaded', () => {
// Setup a library instance.
const doars = new window.Doars()
// Setup the plugin.
const doarsView = new window.DoarsView(doars /*, options */)
// Enable library.
doars.enable()
})
</script>
ESM and IIFE builds are also available via the jsDelivr CDN.
The following directives are added by the plugin.
Executes the attribute when an intersection change is observed on the element.
The directive's value should be a function expression. The directive's name can
either be nothing, enter, or leave. If the name is enter the directive is
only ran when the element enters into view, if the name is leave the directive
is only ran when the element exist out of view. If neither is given the
directive is run in either case.
The directive supports the following modifiers.
{Number} buffer = 5 Amount of times it has to be triggered before the
directive is called.{Number} debounce = 500 Time in milliseconds the element needs to have been
in view before the expression is executed.{Number} throttle = 500 Time in milliseconds before the directive can be
executed again.<div d-view="console.log('Element entered or left the viewport.')">
<div d-view:enter="console.log('Element entered the viewport.')">
<div d-view:leave.debounce-750="console.log('Element left the viewport, and has not re-entered for 750 milliseconds.')">
constructor Create plugin instance.
@param {Doars} library A doars library instance.@param {Object} options = null See options.@returns {DoarsView}{HTMLElement} root = null The element to be used as the viewport for
checking the visibility of the elements. It must be an ancestor of the
targeted elements. By default it is the browsers viewport.{CSS margin property} rootMargin = '0px' Margin around the root.{Number|Array<Number>} threshold = 0 Thresholds of visibility the directive
should be executed. 0 results in as soon as a pixel is in view. 1 results
in that the entire element needs to be in view. [0, 0.5, 1] results in three
possible calls when it is a pixel in view, 50% in view and entirely in view.The options are the same as those of the intersection observer itself.
FAQs
Doars plugin that adds a view directive for reacting to intersection changes.
We found that @doars/doars-view demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.