
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@matrajs/svelte
Advanced tools
Svelte bindings for Matra — a use: action and a store that follows the editor.
Svelte bindings for Matra: a use: action and a store
that follows the editor.
npm i @matrajs/core @matrajs/svelte
<script>
import { starterKit } from '@matrajs/core'
import { matra } from '@matrajs/svelte'
const { action, editor, state } = matra({
extensions: starterKit,
content: '<p>Hello</p>',
})
</script>
<button onclick={() => editor.commands.toggleBold()}
aria-pressed={$state.isActive('bold')}>
Bold
</button>
<div use:action></div>
Svelte already has the right shape for this — an action runs when the element exists and is told when it goes away — so the binding is thin on purpose. What it adds over eight lines written inline is the two things people get wrong:
$state republishes on every change and every selection move,
so a toolbar's pressed states come from the document rather than from what
was last clicked.The editor is created immediately rather than on mount, so commands,
getJSON() and getText() all work before anything is on screen — which is
what a server render and a test both need.
Stores, not runes, so the same package works in both. A rune-only build would
be a version boundary in exchange for nothing: $state on a store reads
identically.
Matra ships no appearance. See the styling guide.
MIT.
FAQs
Svelte bindings for Matra — a use: action and a store that follows the editor.
The npm package @matrajs/svelte receives a total of 13 weekly downloads. As such, @matrajs/svelte popularity was classified as not popular.
We found that @matrajs/svelte demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.