
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@spon/plugins
Advanced tools
npm install @spon/core @spon/domevents @spon/plugins --save or yarn add @spon/core @spon/domevents @spon/plugins --save
Peer Dependency
See @spon/core for documentation
import { withPlugins, device } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Object} props.plugins.device
* @return {Function} a function to unmount
*/
function example({ node, plugins: { device } }) {
device.width // the current viewport width
device.height // the current viewport height
device.resize(() => {
// called when the window resizes
})
device.at('(min-width="1024px")', {
on: () => {
// called when the media query matches the current viewport
},
off: () => {
// called when the media query does not match the current viewport
}
})
device.cancel() // stop listening to resize events
}
export default withPlugins(device)(example)
import { withPlugins, inview } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Object} props.plugins.inview
* @return {Function} a function to unmount
*/
function example({ node, plugins: { inview } }) {
// watch the node
inview.observe({
enter: (entry, observer) => {
// called when the node enters the viewport
},
exit: (entry, observer) => {
// called when the node exits the viewport
}
})
// watch some other nodes
inview.observe(document.querySelectorAll('[data-inview]'), {
enter: (entry, observer) => {
// called when the node enters the viewport
},
exit: (entry, observer) => {
// called when the node exits the viewport
}
})
inview.disconnect() // remove any intersection observers
}
export default withPlugins(inview)(example)
import { withPlugins, mutation } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Function} props.plugins.mutation
* @return {Function} a function to unmount
*/
function example({ node, plugins: { mutation } }) {
// watch the node
const { observe, disconnect } = mutation(node, {
attributes: true,
childList: false,
subtree: false
})
observe(() => {
// called when a mutation happens on the node
})
disconnect() // remove any mutation observers
}
export default withPlugins(mutation)(example)
import { withPlugins, resize } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Function} props.plugins.resize
* @return {Function} a function to unmount
*/
function example({ node, plugins: { resize } }) {
// watch the node
const { observe, disconnect } = resize(node)
observe(() => {
// called when a the element changes size
})
disconnect() // remove any resize observers
}
export default withPlugins(resize)(example)
import { withPlugins, scroll } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Object} props.plugins.scroll
* @return {Function} a function to unmount
*/
function example({ node, plugins: { scroll } }) {
// watch the node
scroll.progress(() => {
// called as the user scrolls
})
scroll.start(() => {
// called when the user starts scrolling
})
scroll.stop(() => {
// called when the user stops scrolling
})
scroll.destroy() // remove the scroll event
}
export default withPlugins(resize)(example)
import { withPlugins, domEvents } from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Function} props.plugins.addEvents
* @return {Function} a function to unmount
*/
function example({ node, plugins: { addEvents, removeEvents, removeEvent } }) {
// watch the node
// add events, delegated to the node
addEvents({
'click [data-toggle-button]': (e, elm) => {
e.preventDefault()
elm.classList.toggle('is-active')
},
'mouseenter [data-toggle-button]': [
(e, elm) => {
e.preventDefault()
elm.classList.toggle('is-active')
},
true // capture value
]
})
// delegate events to the body
addEvents(document.body, {
'click [data-toggle-button]': (e, elm) => {
e.preventDefault()
elm.classList.toggle('is-active')
}
})
removeEvents() // remove all events
removeEvent('click [data-toggle-button]') // remove event by 'event selector'
}
export default withPlugins(domEvents)(example)
import {
withPlugins,
domEvents,
scroll,
inview,
mutation,
device,
resize
} from '@spon/plugins'
/**
* @function example
* @param {Object} props
* @property {HTMLElement} props.node
* @property {Object} props.plugins
* @property {Function} props.plugins.addEvents
* @return {Function} a function to unmount
*/
function example({
node,
plugins: { addEvents, inview, mutation, device, resize, scroll }
}) {
// do stuff
}
export default withPlugins(domEvents, inview, mutation, device, resize, scroll)(
example
)
FAQs
spon
We found that @spon/plugins demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.