Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@layerhq/web-xdk
Advanced tools
The Layer eXperience SDK for Web provides a library for talking to Layer Services, and a library of widgets to simplify adding chat capabilities into your application.
Browser | Version | OS Tested Against |
---|---|---|
Internet Explorer | 11.0 | Windows 8.1 |
Edge | 16.0 | Windows 10 |
Edge | 13.0 | Windows 10 |
Safari | 11.0 | OSX 10.13 |
Safari | 10.0 | OSX 10.12 |
Safari (IOS) | default | IOS 11.1 |
Safari (IOS) | default | IOS 10.0 |
Chrome | 55 | OSX 11.0 |
Chrome | 48 | Linux |
Firefox | 58 | Windows 10 |
The Layer Web XDK provides a library of widgets to simplify adding chat capabilities into your application.
It is implemented using the Webcomponents Polyfill; in particular, this project uses the "light" version of the polyfill which means we do not use Shadow Dom.
<script src='https://cdn.layer.com/xdk/4.0.0/layer-xdk.min.js'></script>
<link rel='stylesheet' href='https://cdn.layer.com/xdk/4.0.0/themes/layer-basic-blue.css' />
<script>
var client = window.Layer.init({
appId: 'layer:///apps/staging/UUID'
});
</script>
npm install @layerhq/web-xdk --save
var Layer = require('layer-xdk');
const client = Layer.init({
appId: 'layer:///apps/staging/UUID'
});
<link rel='stylesheet' href='node_modules/xdk/themes/build/layer-basic-blue.css' />
If using npm link
, note that after cloning this repo, run:
npm install
grunt prepublish
cd npm
npm link .
grunt develop
: Starts a webserver for running tests or sample apps, and watches for changes, rebuilding source and theme on any changegrunt docs
: Generate API Reference docs into folder ~/docs
; you may need to run gem install jsduck
first. Warning: Use Ruby 2.0
; later versions log too many errors.grunt theme
: Generate CSS files from the .less
filesgrunt debug
: Generate all lib folders and basic build files.grunt build
: Run's grunt debug
and grunt theme
and then generates all minified filesgrunt coverage
: Generate a coverage test build; additional steps shown below for running a coverage testTo run coverage tests:
grunt coverage
will write test/coverage-build.js
with an instrumented version of the build filehttp://localhost:8004/test/CoverageRunner.html
coverageResults = {};
Object.keys(__coverage__).forEach(key => {
// Simplify reporting paths by taking 'lib' out of the path
var newKey = key;
// Many components have a path of components/component_name/component_name.js;
// simplify reporting of paths to components/component_name.js
newKey = newKey.replace(/components\/.*\//, "components/");
var parts = newKey.split(/\//);
if (parts[parts.length-2] + '.js' == parts[parts.length-1]) {
parts.splice(parts.length-2, 1);
newKey = parts.join('/');
} else if (newKey.match(/\/ui\/cards\/[^/]+\/[^/]+\.js$/)) {
newKey = newKey.replace(/(\/ui\/cards\/)([^/]+\/)([^/]+\.js)$/, "$1$3");
console.log("newKey: " + newKey);
}
coverageResults[newKey] = __coverage__[key];
})
copy(JSON.stringify(coverageResults))
coverage/coverage.json
istanbul report --root coverage --dir coverage/report html
open coverage/report/index.html
ConversationPanel.composeButtons
one must dom create elements,
put them in an array and then set composeButtons
to refer to them. This is especially bad in React. A better mechanism should be discussed,
and implemented.JSDuck is used to document this system. Properties and Methods are flagged as public/protected/private according to rules somewhat different from standard:
onXXX
are not for calling publicly, but rather for customizing with mixins. They are public in the sense that they have been explicitly exposed for customization.@protected
. These will not always strictly follow rules for what it means to be Protected in Object Oriented terminologyGetting jsduck build to work:
gem install jsduck
FAQs
The Layer eXperience SDK for Web provides a library for talking to Layer Services, and a library of widgets to simplify adding chat capabilities into your application.
The npm package @layerhq/web-xdk receives a total of 7 weekly downloads. As such, @layerhq/web-xdk popularity was classified as not popular.
We found that @layerhq/web-xdk demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 27 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.