Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@myuw-web-components/myuw-profile
Advanced tools
Web component that provides an avatar button and profile menu
Import and include the component as follows, but note that it will not display by default, until initialized through its event API!
<!-- import the module -->
<script type="module" src="https://unpkg.com/@myuw-web-components/myuw-profile@latest?module"></script>
<!-- fallback for browsers without ES2015 module support -->
<script nomodule src="https://unpkg.com/@myuw-web-components/myuw-profile@latest"></script>
<!-- initialize -->
<script>
customElements
.whenDefined('myuw-profile')
.then(() => document.dispatchEvent(new CustomEvent('myuw-login', { detail: {} })))
;
</script
<myuw-profile
login-url=""
logout-url=""
background-color=""
></myuw-profile>
Note: The evergreen "latest" version can be used for convenience, but in production settings it is recommended to use the latest release version specifically, and upgrade only after testing!
Because it has multiple states depending on whether there is an active session, all elements of the profile component are hidden by default. The component listens for a CustomEvent called "myuw-login" and its state is dependent on the data you pass when you dispatch that event:
/*
Notes about configuring the event:
- The event MUST contain a "detail" object. The contents of the detail object determine what the component will display:
- An empty "detail" object ( detail: {} ) will result in the login button being displayed
- An empty "person" object ( person: {} ) will result in a generic session being displayed (using the person icon). This should only be used when the session doesn't provide a user's name, username, email, etc.
- A person object containing a "firstName" ( person: {firstName: "Name"} ) will result in the full session display
- The "bubbles" property is optional unless you're dispatching the event from an element/scope other than "document"
*/
var customEvent = new CustomEvent('myuw-login', {
bubbles: true, // optional
detail: { // required always
person: { // required for generic session display
"firstName": "User" // required for full session display
}
}
});
// Dispatch the event
document.dispatchEvent(customEvent);
If you want the component to show something on the initial page load (and not be hidden), make sure to dispatch the "myuw-login" event after all web components are loaded and upgraded (i.e. ready to be interacted with). The webcomponentsjs polyfill provides and event you can hook into:
document.addEventListener('WebComponentsReady', function() {
var customEvent = new CustomEvent('myuw-login', {
// Configure the event data to display what you want
});
// Dispatch the event
document.dispatchEvent(customEvent);
});
<a>
tag--myuw-profile-font
: Set the font stack for this component--myuw-profile-login-color
: Set the font color of the "Login" button--myuw-profile-background-color
: Set the background color of the circular menu button--myuw-menu-color
: The text color of links/buttons in the profile menuFor more information about CSS variables and how they work with MyUW Web Components, reference the styles component
Cross-browser testing provided by:
Update version using npm version with appropriate selection: patch, minor, or major
.
Deploy npm package to the world using npm publish
(if you don't have publish rights contact authors).
Push git changes to the github via git push origin master
.
1.7.0
FAQs
Web component that provides an avatar button and profile menu
We found that @myuw-web-components/myuw-profile demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.