
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
@koddsson/textarea-caret
Advanced tools
(x, y) coordinates of the caret in a textarea or input type='text'
Get the top and left coordinates of the caret in a <textarea> or
<input type="text">, in pixels. Useful for textarea autocompletes like
GitHub or Twitter, or for single-line autocompletes like the name drop-down
in Twitter or Facebook's search or the company dropdown on Google Finance.
How it's done: a faux <div> is created off-screen and styled exactly like the
textarea or input. Then, the text of the element up to the caret is copied
into the div and a <span> is inserted right after it. Then, the text content
of the span is set to the remainder of the text in the <textarea>, in order to
faithfully reproduce the wrapping in the faux div (because wrapping can push
the currently typed word onto the next line). The same is done for the
input to simplify the code, though it makes no difference. Finally, the span's
offset within the textarea or input is returned.
Check out the JSFiddle or the test.html.
<textarea>s and <input type="text"> elements<textarea>var getCaretCoordinates = require('textarea-caret');
document.querySelector('textarea').addEventListener('input', function () {
var caret = getCaretCoordinates(this, this.selectionEnd);
console.log('(top, left, height) = (%s, %s, %s)', caret.top, caret.left, caret.height);
})
element is the DOM element, either an <input type="text"> or textarea
position is an integer indicating the location of the caret. Most often you'll want to pass this.selectionStart or this.selectionEnd. This way, the library isn't opinionated about what the caret is.
The function returns a caret coordinates object of the form {top: , left: , height: }, where:
top and left are the offsets in pixels from the upper-left corner of the element and (or presumably the upper-right, but this hasn't been tested), andheight is the height of the caret - useful to calculate the bottom of the caret.<textarea>s (#29). This may be a bug in how browsers render the caret.<input> (#40). The caret position can be quite off in this case.<textarea>s aren't supported in IE9 (#14)None.
currentStyleFor the same textarea of 25 rows and 40 columns, Chrome 33, Firefox 27 and IE9 returned completely different values
for computed.width, textarea.offsetWidth, and textarea.clientWidth. Here, computed is getComputedStyle(textarea):
Chrome 33
computed.width : "240px" = the text itself, no borders, no padding, no scrollbarstextarea.clientWidth: 280 = computed.width + padding-left + padding-righttextarea.offsetWidth: 327 = clientWidth + scrollbar (15px) + border-left + border-rightIE 9: scrollbar looks 16px, the text itself in the text area is 224px wide
computed.width: "241.37px" = text only + sub-pixel scrollbar? (1.37px)textarea.clientWidth: 264textarea.offsetWidth: 313Firefox 27
computed.width: "265.667px"textarea.clientWidth: 249 - the only browser where textarea.clientWidth < computed.widthtextarea.offsetWidth: 338FAQs
(x, y) coordinates of the caret in a textarea or input type='text'
The npm package @koddsson/textarea-caret receives a total of 34 weekly downloads. As such, @koddsson/textarea-caret popularity was classified as not popular.
We found that @koddsson/textarea-caret demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.