
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@ephox/alloy
Advanced tools
alloy is a UI library that specialises in creating reusable behaviours and components that are not opinionated about DOM structure and styling. It is a very low-level library.
A webserver to run demos, npm, webpack is required to run and develop alloy
alloy is available as an npm package. You can install it via the npm package @ephox/alloy
yarn install the dependencies
webpack compile the src code
alloy uses bedrock to run its tests. If you are running the browser tests, you may need to ensure that you have valid webdrivers on your path. You can install many of the webdrivers through npm.
There are four kinds of tests that alloy runs:
$ yarn run test
This will run the console tests in chrome-headless.
The browser tests are in the src/test/js/browser directory. They do not require a webdriver and can be run using the bedrock mode (rather than bedrock-auto).
$ bedrock --testdir src/test/js/browser
In this mode, bedrock will not open the browser, nor will it close it. This mode is used for development and debugging.
Some tests in alloy need to access raw WebDriver APIs like sendKeys. This allows tests to use selenium to provide actual real key events, rather than simulated JavaScript events. However, to run these tests, you need to use bedrock-auto. The tests are stored in the src/test/js/webdriver directory.
For example, to run the tests on Chrome:
$ bedrock-auto -b chrome --testdir src/test/js/webdriver
Note, webdriver tests are still rather fragile.
We are currently working on documenting the alloy APIs. For now, there are many demos available in src/demo/html that demonstrate how to use alloy. Be aware that the library is still in a state of constant adjustment.
FAQs
Ui Framework
The npm package @ephox/alloy receives a total of 1,614 weekly downloads. As such, @ephox/alloy popularity was classified as popular.
We found that @ephox/alloy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.