
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The @m3e/core package delivers the essential primitives, utilities, and behavioral mixins for building Material 3 web components. It serves as the foundation for accessibility, layout, platform detection, design tokens, keycodes, and more—enabling consistent, scalable, and maintainable development across the monorepo.
This package is part of M3E monorepo, a unified suite of Material 3 web components. Explore the docs to see them in action.
npm install @m3e/core
This package includes a Custom Elements Manifest to support enhanced editor tooling and developer experience.
To enable autocomplete and hover documentation for @m3e/core, install the Custom Elements Manifest Language Server extension. It will automatically detect the manifest bundled with this package and surface tag names, attributes, slots, and events in supported files.
Alternately, you can explicitly reference the html-custom-data.json and css-custom-data.json in your workspace settings:
{
"html.customData": ["./node_modules/@m3e/core/dist/html-custom-data.json"],
"css.customData": ["./node_modules/@m3e/core/dist/css-custom-data.json"]
}
The following entry points are available as defined in the package's exports field:
@m3e/core (default): Main entry point for core exports@m3e/core/a11y: Accessibility utilities and primitives@m3e/core/anchoring: Anchoring utilities and primitives@m3e/core/bidi: Bidirectional text utilities@m3e/core/layout: Layout utilities and primitives@m3e/core/platform: Platform detection utilitiesSee the root monorepo CONTRIBUTING.md for guidelines on contributing to this package.
This package is licensed under the MIT License.
FAQs
Core for M3E
We found that @m3e/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.