
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@squarespace/ancillary
Advanced tools
Ancillary is a layout script to move a set of "element" DOM nodes into a set of "container" DOM nodes based on a series of "setting" class names on the <body> element that describe positioning. It finds out about which DOM nodes are elements and which are containers through the presence of the data-attributes data-nc-element and data-nc-container. Ancillary can be instantiated many times on one page.
NOTICE: This code is licensed to you pursuant to Squarespace’s Developer Terms of Use. See license section below.
Before Ancillary:
<body class="ancillary-header-logo-position-left ancillary-header-nav-position-right ancillary-header-cta-position-right">
<header data-nc-base="header">
<div data-nc-container="left">
<h1 data-nc-element="logo"></h1>
<nav data-nc-element="nav"></nav>
<button data-nc-element="cta"></button>
</div>
<div data-nc-container="right"></div>
</header>
</body>
After Ancillary:
<body class="ancillary-header-logo-position-left ancillary-header-nav-position-right ancillary-header-cta-position-right">
<header data-nc-base="header">
<div data-nc-container="left">
<h1 data-nc-element="logo"></h1>
</div>
<div data-nc-container="right">
<nav data-nc-element="nav"></nav>
<button data-nc-element="cta"></button>
</div>
</header>
</body>
Create an element to wrap all your Ancillary elements. This base element should have the data-attribute data-nc-base, and the attribute value should reflect the string that comes after 'ancillary' in the body class names.
<header data-nc-base="header"></header>
Create container elements inside your base, and give them the data-attribute data-nc-container, with the value matching the string that comes after 'position' at the end of the body class names. NOTE: If a body class name refers to a container that is not present on the page as a data-nc-container, the corresponding element will be removed from the DOM. This can be useful – for example, a body class name of ancillary-header-logo-position-none will remove <h1 data-nc-element="logo"> from the DOM entirely, as long as there is no <div data-nc-container="none"> present in the DOM.
<div data-nc-container="left"></div>
<div data-nc-container="right"></div>
Lastly, create the actual Ancillary elements and assign them the data-attribute data-nc-element, which should again match the strings that refer to the elements inside the body class names.
<h1 data-nc-element="logo"></h1>
<nav data-nc-element="nav"></nav>
<button data-nc-element="cta"></button>
You've completed the process of creating your Ancillary layout. Feel free to put whatever you wish inside each data-nc-element.
import Ancillary from '@squarespace/ancillary';
const header = document.querySelector('[data-nc-base="header"]');
const headerAncillary = new Ancillary(header);
headerAncillary.sync();
If you prefer to handle transpiling and polyfilling on your own, you can import ES6 from Ancillary:
import ancillary from '@squarespace/ancillary/src';
Alternately, Ancillary specifies a module property in package.json that points to the uncompiled src/index.js, so you may be able to simply import @squarespace/ancillary if you're using one of the following bundlers:
Portions Copyright © 2016 Squarespace, Inc. This code is licensed to you pursuant to Squarespace’s Developer Terms of Use, available at http://developers.squarespace.com/developer-terms-of-use (the “Developer Terms”). You may only use this code on websites hosted by Squarespace, and in compliance with the Developer Terms. TO THE FULLEST EXTENT PERMITTED BY LAW, SQUARESPACE PROVIDES ITS CODE TO YOU ON AN “AS IS” BASIS WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED.
FAQs
Moves elements into the right place
The npm package @squarespace/ancillary receives a total of 1 weekly downloads. As such, @squarespace/ancillary popularity was classified as not popular.
We found that @squarespace/ancillary demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.