Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@myuw-web-components/myuw-help-link
Advanced tools
This Web Component presents a stylized link to help.
To use the myuw-help-link
web component,
<script>
, and<myuw-help-link>
element.MyUW provides a local CDN-like (Content Delivery Network-like) affordance.
Rely upon the latest v1-compatible release
<script
type="module"
src="/static/web-components/myuw/myuw-help-link/1-x/myuw-help-link.min.mjs"></script>
<script
nomodule
src="/static/web-components/myuw/myuw-help-link/1-x/myuw-help-link.min.js"></script>
(See documentation about myuw-help-link in static for more conservative options.)
In HTML <head>
,
<script type="module" src="https://unpkg.com/@myuw-web-components/myuw-help-link@^1?module"></script>
<script nomodule src="https://unpkg.com/@myuw-web-components/myuw-help-link@^1"></script>
to import via unpkg.
WARNING: unpkg is a third-party service neither provided nor endorsed by MyUW.
In a MyUW context, sourcing from /static
is preferred.
Alternatively include the web component files locally in the application and import from there.
Use the component's in the HTML page:
<myuw-help-link
app-context="Payroll"
url="https://uwservice.wisc.edu/help/payroll">
</myuw-help-link>
The app-context
attribute clarifies the scope and context of the help linked.
Implementation detail: myuw-help-link
uses it to compose the link label, as
{app-context} resources and help
. (This is an implementation detail, not a
guarantee of the API exposed by myuw-help-link
).
The url
attribute tells the web component where the link should take the user.
Absolute links (starting with http
) open in a new tab (via target='_blank'
with the page-jacking-prevention workaround of rel='noopener noreferrer'
).
Carefully practicing Semantic Versioning allows downstream applications making
use of myuw-help-link
to automatically, transparently upgrade to the latest
compatible version of the component.
If a change is not backwards-compatible, it MUST yield a MAJOR version number bump, e.g. from 1.1.12 to 2.0.0.
Update CHANGELOG.md
to document the changes. This is useful documentation, and
it's also a prompt to think about the nature of the changes and to ensure that
they are backwards-compatible.
npm install
npm start
Visit http://127.0.0.1:8080/docs/ .
First, update package.json
to reflect the version number you intend to
release.
Then
npm publish --public
and capture the /dist/
outputs to myuw-shared-static.
Immediately release a new PATCH version that restores compatibility.
1.1.0
If the url
attribute begins with http
, instructs browser to open the link in
a new tab (target='_blank'
and rel='noopener noreferrer'
)
FAQs
Stylized hyperlink to help content.
The npm package @myuw-web-components/myuw-help-link receives a total of 1 weekly downloads. As such, @myuw-web-components/myuw-help-link popularity was classified as not popular.
We found that @myuw-web-components/myuw-help-link demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.