
Research
TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.
@ikas/popup-script-injector
Advanced tools
Standalone popup widget renderer extracted from the storefront codebase. It can
be consumed as a plain <script> bundle or as a React component inside
Next/React applications.
# install workspace dependencies first (from repo root)
npm install
# then build the widget bundle
npm run build --workspace @ikas/popup-widget
The build command produces three artefacts under dist/:
popup-widget.es.jspopup-widget.cjs.jspopup-widget.iife.js – automatically calls startIkasPopupWidget() after
loading and registers a global IkasPopupWidget namespace.Source maps are emitted for all formats.
The widget expects its configuration under window.ikasPopupConfig. The
runtime type is exported as PopupWidgetConfig:
import type { PopupWidgetConfig } from "@ikas/popup-widget";
const exampleConfig: PopupWidgetConfig = {
popups: [], // fill with IkasStorefrontPopup objects returned by your API
sessionId: "session-123",
locale: "en",
countryCode: "US",
merchantId: "merchant-id",
cdnUrl: "https://cdn.myikas.dev/",
storeUrl: "https://demo.myikas.dev",
customerToken: undefined,
priceListId: "price-list-id",
salesChannelId: "sales-channel-id",
customer: {
email: "jane@example.com",
firstName: "Jane",
lastName: "Doe",
},
services: {
searchProducts: async () => [],
addItemToCart: async () => ({ success: true }),
saveCustomerFormData: async () => {},
getLastViewedProducts: async () => [],
formatVariantSellPrice: () => "₺0,00",
formatVariantDiscountPrice: () => null,
hasVariantDiscount: () => false,
getVariantDiscountPercentage: () => null,
},
};
Populate all relevant fields before loading the script.
Populate window.ikasPopupConfig before
loading the bundle:
import type { PopupWidgetConfig } from "@ikas/popup-widget";
const ikasPopupConfig: PopupWidgetConfig = {
popups: [], // fill with IkasStorefrontPopup objects
sessionId: "session-123", // used for localStorage tracking
locale: "en",
countryCode: "US",
merchantId: "merchant-id",
cdnUrl: "https://cdn.myikas.dev/",
storeUrl: "https://demo.myikas.dev",
customerToken: undefined, // optional
priceListId: "price-list-id",
salesChannelId: "sales-channel-id",
services: {
searchProducts: async (params) => {
console.log("search products", params);
return [];
},
addItemToCart: async ({ product, variant }) => {
console.log("add to cart", product, variant);
return { success: true };
},
saveCustomerFormData: async (payload) => {
console.log("save customer", payload);
},
getLastViewedProducts: async () => {
return [];
},
formatVariantSellPrice: () => "₺0,00",
formatVariantDiscountPrice: () => null,
hasVariantDiscount: () => false,
getVariantDiscountPercentage: () => null,
},
};
window.ikasPopupConfig = ikasPopupConfig;
<link
rel="stylesheet"
href="https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.css"
/>
<script src="./dist/popup-widget.iife.js" defer></script>
Provide the service implementations so the widget can delegate cart operations, customer form submissions and dynamic product fetching back to your storefront.
The IIFE build bootstraps itself once the script executes. When using the
ES/CJS bundles you can call startIkasPopupWidget() manually:
import { startIkasPopupWidget } from "@ikas/popup-widget";
startIkasPopupWidget(window.ikasPopupConfig);
import dynamic from "next/dynamic";
const PopupListRendererForPage = dynamic(() =>
import("@ikas/popup-widget").then((mod) => mod.PopupListRendererForPage),
{ ssr: false }
);
// … inside component tree
<PopupListRendererForPage />;
The startIkasPopupWidget helper can also be called from React apps if you want
an imperative bootstrap (e.g. outside of the main React tree).
dist/*.d.ts). We should add a
tsc build step or rollup-plugin-dts before publishing.window.ikasPopupConfig.popups. No
automatic fetch from the storefront API is performed.These items are tracked as follow-up tasks before we deprecate the original
packages/storefront/src/components/popup implementation.
FAQs
Standalone popup widget renderer for ikas storefront popups.
We found that @ikas/popup-script-injector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.