
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@naissur/firepad
Advanced tools
Firepad is an open-source, collaborative code and text editor. It is designed to be embedded inside larger web applications.
Visit firepad.io to see a live demo of Firepad in rich text mode, or the examples page to see it setup for collaborative code editing.
Firepad uses Firebase as a backend, so it requires no server-side code. It can be added to any web app by including a few JavaScript files
<!-- Firebase -->
<script src="https://cdn.firebase.com/js/client/2.2.4/firebase.js"></script>
<!-- CodeMirror -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.2.0/codemirror.js"></script>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.2.0/codemirror.css"/>
<!-- Firepad -->
<link rel="stylesheet" href="https://cdn.firebase.com/libs/firepad/1.3.0/firepad.css" />
<script src="https://cdn.firebase.com/libs/firepad/1.3.0/firepad.min.js"></script>
and calling an init function.
<div id="firepad"></div>
<script>
var firepadRef = new Firebase('<FIREBASE URL>');
var codeMirror = CodeMirror(document.getElementById('firepad'), { lineWrapping: true });
var firepad = Firepad.fromCodeMirror(firepadRef, codeMirror,
{ richTextShortcuts: true, richTextToolbar: true, defaultText: 'Hello, World!' });
</script>
Firepad supports rich text editing with CodeMirror and code editing via ACE. Check out the detailed setup instructions at firepad.io/docs.
Here are some highlights of the directory structure and notable source files:
dist/ - output directory for all files generated by grunt (firepad.js, firepad.min.js, firepad.css, firepad.eot).examples/ - examples of embedding Firepad.font/ - icon font used for rich text toolbar.lib/
firepad.js - Entry point for Firepad.text-operation.js, client.js - Heart of the Operation Transformation implementation. Based on
ot.js but extended to allow arbitrary
attributes on text (for representing rich-text).annotation-list.js - A data model for representing annotations on text (i.e. spans of text with a particular
set of attributes).rich-text-codemirror.js - Uses AnnotationList to track annotations on the text and maintain the appropriate
set of markers on a CodeMirror instance.firebase-adapter.js - Handles integration with Firebase (appending operations, triggering retries,
presence, etc.).test/ - Jasmine tests for Firepad (many of these were borrowed from ot.js).We love pull requests. If you'd like to contribute to Firepad, run the following commands to get your environment set up:
$ git clone https://github.com/firebase/firepad.git
$ cd firepad # go to the firepad directory
$ npm install -g grunt-cli # globally install grunt task runner
$ npm install -g bower # globally install Bower package manager
$ npm install # install local npm build / test dependencies
$ bower install # install local JavaScript dependencies
$ grunt coffee # build coffee once initially (so tests will work)
$ grunt watch # watch for source file changes
grunt watch will watch for changes in the /lib/ directory and lint, concatenate, and minify the
source files when a change occurs. The output files are written to the /dist/ directory.
You can run the test suite by navigating to file:///path/to/firepad/test/index.html or via the
command line using grunt test.
Firepad stores its data in a Firebase database. You can sign up here for a free Firebase account.
Join our Firepad Google Group to ask questions, request features, or share your Firepad apps with the community.
FAQs
Collaborative text editing powered by Firebase
We found that @naissur/firepad demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.