
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@docyrus/dom-selector-client
Advanced tools
A simple CLI that prepares your Vite or Astro project for interactive element selection during development. It injects a lightweight helper script and annotates elements with useful data attributes so external tools can highlight and reference them.
dom-selector-helper.jsdata-component-*data-component-*pnpm add -D @docyrus/dom-selector-clientnpm i -D @docyrus/dom-selector-clientyarn add -D @docyrus/dom-selector-clientRequires Node 18+.
npx dom-selector installpnpm dlx dom-selector install or add it as a dev dep and run dom-selector installThe installer will:
dom-selector-helper.js to your project root (if not present)astro.config.* or vite.config.* to inject a dev-only plugin that includes the helperbabel-plugin-component-annotate.ts to your project root and register a Babel transform in Vite to add data-component-name and data-component-path attributes to JSX elements during devNo changes are made if your config is already set up.
<script type="module" src="/dom-selector-helper.js"></script> into HTML and serves the file from the project rootdata-component-name: The element/component namedata-component-path: Relative file path with line:column (e.g. src/App.tsx:12:5)Annotations are added only in development. The helper and plugins are inert in production builds.
The injected dom-selector-helper.js listens for postMessage events:
window.postMessage({ type: 'DOCY_SELECTOR', action: 'enable' }, '*')window.postMessage({ type: 'DOCY_SELECTOR', action: 'disable' }, '*')When enabled, hovering highlights elements, and clicking sends a message to window.parent:
{ type: 'DOCY_SELECTOR', action: 'elementSelected', payload: { rect, componentName, componentPath, tagName, className, hasTextContent, textContent, src } }This is designed to work inside iframes or dev UIs that consume the selection signal.
dom-selector-helper.js (copied if missing)babel-plugin-component-annotate.ts (React projects, copied if missing)astro.config.* or vite.config.* updated to register dev-only pluginsYou can remove these changes by deleting the two files and reverting the plugin additions in your config.
@babel/core for the inline transform. If it’s not found, the installer will warn you to install it: npm i -D @babel/core.dom-selector install
-d, --directory <dir> target project directory (defaults to CWD)MIT
FAQs
DOM selector CLI client
We found that @docyrus/dom-selector-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.