Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@filamentgroup/tau
Advanced tools
Tau is a small and simple 360 gallery library. The primary goal is to start with a very light weight core and extend it with optional features as part of the build process. The core supports touch, mouse events, and automatic rotation. You can see a demo here.
After including library in your document you can create an instance of Tau with:
var tau = new window.componentNamespace.Tau( domElement );
Where domElement
is an element conforming to the following markup pattern:
<div class="tau" data-tau>
<div class="loading">loading...</div>
<img src="http://example.com/1.png"
data-src-template="http://example.com/$FRAME.png"
data-frames="72"
data-reduced-step-size="4"
data-auto-rotate-delay="200"></img>
</div>
The default img
provides a fallback for browsers that fail to execute the instantiation. The data-src-template
will be used to create the rest of the images images inside the parent element annotated with data-tau
. Finally, an element tagged with the loading
class will be displayed when the rotation hits an image that hasn't yet fired its loading event. It can be customized with additional markup and CSS as needs be.
Internet Explorer (up to and including 11) decodes the images slowly enough that they blink as they do the initial automatic rotation. To get IE to decode the images sooner we create a div
inside the Tau element and load each of the images as 1px width and height, and then remove them once they are all loaded.
The following attributes are required on the initial img
unless otherwise specified.
data-src-template
- the template for the additional img
tags inserted by Taudata-frames
- the number of images to be inserteddata-reduced-step-size
- factor of reduction for less capable browsers (ie, browsers with no raf)data-auto-rotate-delay
- ms to wait after initialization to start auto-rotateThe core styles can be found in src/core.css
. The demo page also includes some styles for clarity that are not required by the library:
.tau {
border: 3px solid #ccc;
margin-bottom: 2em;
position: relative;
}
.tau img {
width: 100%;
}
.tau .loading {
position: absolute;
z-index: 2;
left: 0;
top: 0;
}
FAQs
A 360 degree image viewer
We found that @filamentgroup/tau demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.