
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@github/arianotify-polyfill
Advanced tools
Polyfill for the ARIA Notification API
The goal of this library is to polyfill ariaNotify so that it can be used seamlessly across browsers that support the native functionality, and those that don't. This adds the Element.prototype.ariaNotify and/or Document.prototype.ariaNotify functions if they do not exist, emulating the native functionality.
This is used in production on github.com.
In browsers where ariaNotify is supported it will emit a notification event. In browsers where it isn't supported this library will create a "fake" element that is an aria-live region, insert it into the DOM, and modify the text content of the element to place the given message in, achieving a similar effect to the native functionality.
This is only meant to be used in a browser context. It should not be used on the server. To install this you will likely need npm.
$ npm i @github/arianotify-polyfill
In your JavaScript you can introduce the polyfill using a "bare" import:
import "@github/arianotify-polyfill"
Then continue to use ariaNotify as if it were supported everywhere. A small contrived example:
button.ariaNotify("Saved")
This project is licensed under the terms of the MIT open source license. Please refer to MIT for the full terms.
The @github/accessibility and @github/primer teams maintain this library.
This library is provided "as is". Please feel free to file issues; however, we offer no time frame for correspondence or resolution of any issues.
Special thanks to Microsoft and the ARIA Working Group for making ariaNotify a possibility.
FAQs
Polyfill for the ARIA Notification API
The npm package @github/arianotify-polyfill receives a total of 949 weekly downloads. As such, @github/arianotify-polyfill popularity was classified as not popular.
We found that @github/arianotify-polyfill demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 18 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.