
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@magicbell/in-app
Advanced tools
[!IMPORTANT] This is an early release, docs are lacking. Please look at
@magicbell/magicbell-reactor@magicbell/embeddableif you're looking for something stable.
Install dependencies:
npm i
This sample uses the TypeScript compiler to produce JavaScript that runs in modern browsers.
To build the JavaScript version of your component:
npm run build
To watch files and rebuild when the files are modified, run the following command in a separate shell:
npm run build:watch
Both the TypeScript compiler and lit-analyzer are configured to be very strict. You may want to change tsconfig.json to make them less strict.
This sample uses modern-web.dev's @web/test-runner for testing. See the modern-web.dev testing documentation for more information.
Tests can be run with the test script, which will run your tests against Lit's development mode (with more verbose errors) as well as against Lit's production mode:
npm test
For local testing during development, the test:dev:watch command will run your tests in Lit's development mode (with verbose errors) on every change to your source files:
npm test:watch
Alternatively the test:prod and test:prod:watch commands will run your tests in Lit's production mode.
This sample uses modern-web.dev's @web/dev-server for previewing the project without additional build steps. Web Dev Server handles resolving Node-style "bare" import specifiers, which aren't supported in browsers. It also automatically transpiles JavaScript and adds polyfills to support older browsers. See modern-web.dev's Web Dev Server documentation for more information.
To run the dev server and open the project in a new browser tab:
npm run serve
There is a development HTML file located at /dev/index.html that you can view at http://localhost:8000/dev/index.html. Note that this command will serve your code using Lit's development mode (with more verbose errors). To serve your code against Lit's production mode, use npm run serve:prod.
If you use VS Code, we highly recommend the lit-plugin extension, which enables some extremely useful features for lit-html templates:
The project is setup to recommend lit-plugin to VS Code users if they don't already have it installed.
Linting of TypeScript files is provided by Biome and TypeScript. In addition, lit-analyzer is used to type-check and lint lit-html templates with the same engine and rules as lit-plugin.
To lint the project run:
npm run lint
Components are published as unoptimized JavaScript modules and performing build-time optimizations should happen at the application level. This gives build tools the best chance to deduplicate code, remove dead code, and so on.
Please check the Publishing best practices for information on publishing reusable Web Components, and Build for production for building application projects that include LitElement components, on the Lit site.
See Get started on the Lit site for more information.
FAQs
MagicBell web components for in-app notifications
We found that @magicbell/in-app demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.