
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@jsplumb/katavorio
Advanced tools
Katavorio is a lightweight drag/drop handler, supporting containment, multiple element drag, custom css classes, drop filters, drag filters, drag clones, drag handles, constraining movement to a grid, and zooming.
Katavorio does not work "out of the box" - it was developed as part of jsPlumb 1.6.0, to support a "no dependency" version (all previous versions of jsPlumb required either jQuery, MooTools or YUI, to provide a bunch of functionality such as CSS manipulation, getting/setting element positions, supporting drag/drop etc). So, rather than re-write simple methods such as addClass, removeClass, getPosition etc, Katavorio expects those methods to be provided in the constructor's options object.
All is not lost, though, as this project also contains DefaultKatavorioHelper - the set of missing methods.
npm install katavorio
NOTE: Katavorio does not follow strict semantic versioning. It is not at all recommended that you use wildcards when specifying a dependency on Katavorio.
None
If you have jsPlumb in your page then you already have Katavorio - it is bundled into jsPlumb. Otherwise you'll need to import two scripts:
node_modules/katavorio/src/default-katavorio-helper.js
node_modules/katavorio/src/katavorio.js
For more information, take a look in the wiki.
17 Sep 2020
elementRemoved to check if an element is in fact draggable/droppable before running the code to de-register it.ghostProxyParent when using a ghost proxy to drag.addSelector method. You can make some element draggable and then
attach more listeners to that object, rather than having to create a whole new draggable:let d = katavorioInstance.draggable(someElement, {
selector:".childSelector",
start:function(p) { ... },
etc
});
d.addSelector({
selector:".someOtherChildSelector",
start:function(p) { ... },
etc
});
selector in the params), we use the class katavorio-delegated-draggable now, instead of
where we previously used the default draggable class of katavorio-draggable. This can also be overridden in the constructor by setting the
value of delegatedDraggable.FAQs
Lightweight drag/drop handler
We found that @jsplumb/katavorio demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.