
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@sec-ant/flat-drop-files
Advanced tools
The is a fork of placemark/flat-drop-files with some modifications for it to be align with GoogleChromeLabs/browser-fs-access
The input is a dataTransfer.items list with some optional options, and the output is a normalized list of files, each of which has an optional handle property, which is a FileSystemFileHandle, an optional directoryHandle property, which is a FileSystemDirectoryHandle and a webkitRelativePath property that's a reconstructed relative file path if the file locates in a directory, or an empty string "" otherwise. The behavior of extending the File interface in this module is in consistent with what's done in GoogleChromeLabs/browser-fs-access.
This module takes care of:
webkitRelativePathsDataTransferItem.getAsFileSystemHandle() is supportedFileSystemEntry API when DataTransferItem.getAsFileSystemHandle() is not supportedThis module DOES NOT take care of
Install from npm:
yarn add @sec-ant/flat-drop-files
Install from GitHub:
yarn add https://github.com/Sec-ant/flat-drop-files
import { getFilesFromDataTransferItems } from "@sec-ant/flat-drop-files";
const zone = document.getElementById("zone");
zone.addEventListener("dragenter", (e) => {
e.preventDefault();
});
zone.addEventListener("dragover", (e) => {
e.preventDefault();
});
zone.addEventListener("drop", (e) => {
e.preventDefault();
getFilesFromDataTransferItems(e.dataTransfer.items, {
recursive: true,
}).then((files) => {
console.log(files);
});
});
type SkipDirectory = (
e: FileSystemDirectoryEntry | FileSystemDirectoryHandle
) => boolean;
interface DropOptions {
// Set to `true` to recursively collect files in all subdirectories,
// defaults to `false`.
recursive?: boolean;
// Callback to determine whether a directory should be entered, return `true` to skip.
skipDirectory?: SkipDirectory;
// List of allowed file extensions (with leading '.').
extensions?: string[];
}
declare function getFilesFromDataTransferItems(
dataTransferItems: DataTransferItemList,
options?: DropOptions
): Promise<File[]>;
This module is compatible with modern browsers: the baseline is browsers that support webkitGetAsEntry. It does not support IE11 or any other ancient browsers.
The browser-fs-access module is highly recommended to work with the file objects returned by this module: with it, you can write back to the files using the file.handle property or write back to the directories where the files locate using the file.directoryHandle property.
FAQs
Flatten, normalize, and handle dropped files
We found that @sec-ant/flat-drop-files demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.