
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@fleek-platform/tias-11apr
Advanced tools
A standalone widget that allows users to embed a chatbox on any website to interact with a Fleek agent. This lightweight, customizable widget can be easily integrated into any website with a simple script tag or imported as a React component.
The Fleek Chatbox Widget is a drop-in solution for adding AI chat capabilities to your website. It provides:
To set up the project for development:
git clone https://github.com/fleek-platform/chatbox-widget.git
cd chatbox-widget
npm install
npm install @fleek-platform/agents-chatbox-widget
To start the development server:
npm run dev
This will:
fleek-chatbox-widget/
βββ dist/ # Built files (generated)
βββ src/ # Source code
β βββ components/ # UI components
β β βββ icons/ # SVG icons as React components
β β βββ *.tsx # Component files
β βββ core/ # Core functionality
β β βββ api.ts # API client
β β βββ types.ts # TypeScript type definitions
β β βββ utils.ts # Utility functions
β βββ npm/ # React/NPM package entry point
β β βββ index.ts # NPM package entry
β βββ standalone/ # Standalone script
β β βββ chatbox.ts # Standalone entry point
β βββ global.css # Global styles and CSS variables
βββ examples/ # Example usage
β βββ react-app/ # React example
βββ test/ # Test files
β βββ index.html # Test page for development
βββ package.json # Project dependencies and scripts
βββ rollup.config.js # Rollup build configuration
To build the project for production:
npm run build
npm run build:standalone
npm run build:npm
This creates the following files in the dist/ directory:
dist/chatbox.min.js - The standalone script to be included on websitesdist/index.esm.js - ES module for npm packagedist/index.cjs.js - CommonJS module for npm packagedist/index.d.ts - TypeScript declarationsThis project uses Changesets for versioning and automated releases.
npx changeset
For production use, we recommend using a specific version of the standalone script:
<script
src="https://unpkg.com/@fleek-platform/agents-chatbox-widget@<VERSION>/dist/chatbox.min.js?agentId=<YOUR_AGENT_ID>&token=<YOUR_API_KEY>"
async
></script>
[!NOTE] Replace
<VERSION>,<YOUR_AGENT_ID>and<YOUR_API_KEY>with your own details.
To add the Fleek Chatbox Widget to your website using the standalone script, include the script tag in your HTML:
<script
src="https://unpkg.com/@fleek-platform/agents-chatbox-widget@<VERSION>/dist/chatbox.min.js?agentId=<YOUR_AGENT_ID>&token=<YOUR_API_KEY>&containerId=<YOUR_HTML_ELEMENT_ID>"
async
></script>
[!NOTE] Replace
<VERSION>,<YOUR_AGENT_ID>,<YOUR_API_KEY>and<YOUR_HTML_ELEMENT_ID>with your own details.
agentId (required): Your Fleek agent IDtoken (required): Your TOKEN for authenticationrestApiHost (optional): Custom API host URL (defaults to production URL if not provided)containerId (optional): ID of an existing element to render the widget intoExample:
<script
src="https://unpkg.com/@fleek-platform/agents-chatbox-widget@1.0.0/dist/chatbox.min.js?agentId=abcdef&token=abcdef&containerId=chat-container"
async
></script>
[!WARNING] You must replace the values in the script
srcwith your own details.
When using the containerId parameter, you need to have an element with that ID in your HTML:
<div id="chat-container"></div>
To use the Fleek Chatbox Widget in a React application:
import React from 'react';
import FleekChatbox from '@fleek-platform/agents-chatbox-widget';
function App() {
return (
<div className="App">
<FleekChatbox
agentId="YOUR_AGENT_ID"
token="YOUR_TOKEN"
restApiHost="https://api.custom-domain.com"
colors={{
'color-primary': '#FF69B4',
}}
isWidgetOpen={false}
/>
</div>
);
}
export default App;
agentId (required): Your Fleek agent IDtoken (required): Your token for authenticationcolors (optional): An object with color overridesrestApiHost (optional): Custom API host URL (defaults to production URL if not provided)isWidgetOpen (optional): Boolean to control if the widget is initially open (default: false)Example:
<FleekChatbox
agentId="123"
token="abc123"
restApiHost="https://api.custom-domain.com"
colors={{
'accent-9': '#ff0000',
'neutral-3': '#f5f5f5',
}}
isWidgetOpen={true}
/>
You can specify a custom API host for the widget to connect to by using the restApiHost parameter:
<script
src="https://unpkg.com/@fleek-platform/agents-chatbox-widget@<VERSION>/dist/chatbox.min.js?agentId=<YOUR_AGENT_ID>&token=<YOUR_TOKEN>&restApiHost=https://<REST_API>"
async
></script>
If no restApiHost is specified, the widget will connect to the production API at https://api.fleek.xyz.
This is useful when you need to connect to a custom API endpoint or a self-hosted version of the Fleek API.
You can customize the appearance of the widget by overriding the default colors. This is done by passing a JSON object in the colors parameter:
<script
src="https://unpkg.com/@fleek-platform/agents-chatbox-widget@<VERSION>/dist/chatbox.min.js?agentId=<YOUR_AGENT_ID>&token=<YOUR_API_TOKEN>&colors=%7B%22accent-9%22%3A%22%23ff0000%22%2C%22neutral-3%22%3A%22%23f5f5f5%22%7D"
async
></script>
[!NOTE] Replace
<VERSION>,<YOUR_AGENT_ID>and<YOUR_API_KEY>with your own details.
The colors parameter is a URL-encoded JSON object where:
-- prefixExample (before URL encoding):
{
"accent-9": "#ff0000",
"neutral-3": "#f5f5f5"
}
When using the React component, you can pass the colors directly as an object:
<FleekChatbox
agentId="123"
token="abc123"
colors={{
'accent-9': '#ff0000',
'neutral-3': '#f5f5f5',
}}
/>
--neutral-1 through --neutral-12--accent-1 through --accent-12--warning-1 through --warning-12These color variables can be used to customize the appearance of the widget to match your website's design.
agentId and token are validThe widget outputs information to the browser console that can help with troubleshooting. Check your browser's developer tools console for messages related to the widget's initialization and operation.
This project uses Biome for formatting and linting:
npm run format
npm run format:check
npm run lint
npm run lint:check
This section guides you through the process of contributing to our open-source project. From creating a feature branch to submitting a pull request, get started by:
git checkout -b feat/my-new-featurepnpm testgit commit -m 'chore: π€ my contribution description'git push origin feat/my-new-featureThe develop branch serves as the main integration branch for features, enhancements, and fixes. It is always in a deployable state and represents the latest development version of the application.
Feature branches are created from the develop branch and are used to develop new features or enhancements. They should be named according to the type of work being done and the scope of the feature and in accordance with conventional commits here.
We prefer to commit our work following Conventional Commits conventions. Conventional Commits are a simple way to write commit messages that both people and computers can understand. It help us keep track fo changes in a consistent manner, making it easier to see what was added, changed, or fixed in each commit or update.
The commit messages are formatted as [type]/[scope] The type is a short descriptor indicating the nature of the work (e.g., feat, fix, docs, style, refactor, test, chore). This follows the conventional commit types.
The scope is a more detailed description of the feature or fix. This could be the component or part of the codebase affected by the change.
Here's an example of different conventional commits messages that you should follow:
test: π Adding missing tests
feat: πΈ A new feature
fix: π A bug fix
chore: π€ Build process or auxiliary tool changes
docs: π Documentation only changes
refactor: π‘ A code change that neither fixes a bug or adds a feature
style: π Markup, white-space, formatting, missing semi-colons...
FAQs
A standalone chatbox widget for Fleek agents
We found that @fleek-platform/tias-11apr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authoritiesβ publishing activity, highlighting trends and transparency across the CVE ecosystem.