
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.
@livechat/postmessage
Advanced tools
A library which makes [`postMessage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) communication easier. It's responsible for:
A library which makes postMessage communication easier. It's responsible for:
It's using a custom protocol for a communication - it's using a distinct shape of passed frames. The protocol was designed with different frame types in mind (currently handshake, response, call & emit). Given global nature of window.postMessage communication, it annotates all sent frames with:
Handshake is the point in time when we know that the connection has been established and it's safe to send data between parties.
Both sides of the communication receive a promise object which resolves after the so-called handshake. It's the point in time when we know that the connection has been established and it's safe to send data to the "other side".
Object consisting of data & methods given to the initialization function.
Data (plain values) are being sent to the "other side" and are given to the consumer on the "other side" when initialization promise resolves.
Methods are being registered within instance and can be called remotely by the instance existing on the other side of the communication using instance.call('methodName', ...args).
type Api = {
call: (method: string, ...args: any[]) => Promise<any>,
emit: (event: string, data: any) => void,
off: (event: string, callback: (...args: any[]) => any) => void,
on: (event: string, callback: (...args: any[]) => any) => void,
once: (event: string, callback: (...args: any[]) => any) => void,
}
type Model = { [key: string]: string | number | (...args: any[]) => any }
type Destroy = () => void
type IframeInstance = {
destroy: Destroy,
frame: HTMLIFrameElement,
promise: Promise<Api & {
destroy: Destroy,
frame: HTMLIFrameElement,
data: { [key: string]: string | number }
}>
}
type ParentInstance = {
promise: Promise<Api & {
data: { [key: string]: string | number }
}>
}
function createIframe(
{
container,
url,
targetOrigin,
handshakeRetry,
}: {
container: string
url: string
targetOrigin?: string
handshakeRetry?: { interval?: number; count?: number }
},
model?: Model,
): IframeInstance
function connectToParent(
model?: Model,
options?: { handshakeTimeout?: number },
): IframeInstance
FAQs
A library which makes [`postMessage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) communication easier. It's responsible for:
The npm package @livechat/postmessage receives a total of 1,134 weekly downloads. As such, @livechat/postmessage popularity was classified as popular.
We found that @livechat/postmessage demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.