
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
@plattar/context-messenger
Advanced tools
Context Messenger framework for cross-iframe communication (https://www.plattar.com)
context-messenger allows defining and calling functions and variables across multiple iframes.
// Minified Version ES2015 & ES2019 (Latest)
https://cdn.jsdelivr.net/npm/@plattar/context-messenger/build/es2015/plattar-context-messenger.min.js
https://cdn.jsdelivr.net/npm/@plattar/context-messenger/build/es2019/plattar-context-messenger.min.js
// Standard Version ES2015 & ES2019 (Latest)
https://cdn.jsdelivr.net/npm/@plattar/context-messenger/build/es2015/plattar-context-messenger.js
https://cdn.jsdelivr.net/npm/@plattar/context-messenger/build/es2019/plattar-context-messenger.js
npm install @plattar/context-messenger
This function will then become available to be executed from other context-messenger frameworks from either the parent or child iframes.
Plattar.messenger.self.sum = (arg1, arg2) => {
return arg1 + arg2;
};
From within the iframe itself that has the context-messenger framework, the above function can be executed as follows. Notice that the function is executed asynchronously and handled via a Promise chain.
Plattar.messenger.parent.sum(1,4).then((result) => {
console.log(result); // this will print 5
}).catch((err) => {
console.error(err);
});
The context-messenger framework can also handle asynchronous functions using Promises. Below we define a function that performs a sum asynchronously.
Plattar.messenger.self.sumDelayed = (arg1, arg2) => {
// perform the sum after 3 seconds and return the result
return new Promise((accept, reject) => {
setTimeout(() => {
accept(arg1 + arg2);
}, 3000);
});
};
From within an iframe itself that has the context-messenger framework, the above function can be executed as follows. Notice that nothing changes with the function execution and the results are still handled using a Promise chain. In this instance, the Promise will execute after 3 seconds.
Plattar.messenger.parent.sumDelayed(1,4).then((result) => {
console.log(result); // this will print 5 after 3 seconds
}).catch((err) => {
console.error(err);
});
<iframe id="frame1" src="./your-nested-page.html"></iframe>
Plattar.messenger.self.getBackgroundColor = () => {
return document.body.style.backgroundColor;
};
Plattar.messenger.frame1.getBackgroundColor().then((result) => {
console.log(result); // prints the background color of the iframe
}).catch((err) => {
console.error(err);
});
context-messenger is designed to automatically initialise itself from other instances of context-messenger that exist inside iframes and/or the parent page. Because this process is asynchronous, sometimes the iframe is not ready before calling its functions. To fix this, listen for the onload event for your desired iframe as follows.
Plattar.messenger.onload("frame1", () => {
// iframe with ID of frame1 has finished loading. If this is not called
// then the iframe might not have a Messenger framework
});
The same can be done for the parent page to ensure its loaded before iframes can call parent functions
Plattar.messenger.onload("parent", () => {
// the parent page has finished loading. If this is not called
// then the page might not have a parent page or the parent does not
// have a Messenger framework
});
<iframe id="frame1" src="./your-nested-page.html"></iframe>
<iframe id="frame2" src="./your-nested-page.html"></iframe>
<iframe id="frame3" src="./your-nested-page.html"></iframe>
Plattar.messenger.self.getBackgroundColor = () => {
return document.body.style.backgroundColor;
};
Sometimes its easier to just call the same function on all available iframes on the page at the same time. The context-messenger provides a broadcast functinality that can handle the function call and resolution for you.
// broadcast will call getBackgroundColor() on frame1, frame2 and frame3 automatically.
// the Promise will resolve when all iframes resolve or fail the function call
Plattar.messenger.broadcast.getBackgroundColor().then((results) => {
// results contains the returned data from all 3 iframes
results.forEach((result) => {
if (result.status == "fulfilled") {
console.log(result.value); // prints the returned color
}
});
});
For more details on how this is handled see Promise.allSettled
Storing of variables is done using context-messenger memory
module. All variables are available to be accessed in all contexts. Note that the memory module does not allow storing functions. Use messenger module for that.
Plattar.memory.temp.my_variable = "hello world!";
console.log(Plattar.memory.temp.my_variable); // prints hello world!
Plattar.memory.perm.my_variable = "hello world!";
console.log(Plattar.memory.perm.my_variable); // prints hello world!
context-messenger memory
module provides a watch
function that allows detecting when the variable has changed.
temp
or perm
variable example
// watch temp variable changes for my_temp_variable
Plattar.memory.temp.watch("my_temp_variable", (oldVar, newVar) => {
console.log("old variable was " + oldVar);
console.log("new variable was " + newVar);
});
// watch perm variable changes for my_perm_variable
Plattar.memory.perm.watch("my_perm_variable", (oldVar, newVar) => {
console.log("old variable was " + oldVar);
console.log("new variable was " + newVar);
});
// set initial variables
Plattar.memory.temp.my_temp_variable = "hello world!";
Plattar.memory.perm.my_perm_variable = "hello world!";
// initiate a variable change
Plattar.memory.temp.my_temp_variable = "hello world again!";
Plattar.memory.perm.my_perm_variable = "hello world again!";
FAQs
Context Messenger framework for cross-iframe communication (https://www.plattar.com)
The npm package @plattar/context-messenger receives a total of 64 weekly downloads. As such, @plattar/context-messenger popularity was classified as not popular.
We found that @plattar/context-messenger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.