
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@templatical/editor
Advanced tools
Vue 3 visual drag-and-drop email editor — drop into any web app with one function call.
The visual editor for Templatical — an open-source drag-and-drop email editor with JSON templates and MJML output.
--tpl-user-* CSS variables, dark mode, custom fontsnpm install @templatical/editor
@templatical/renderer is an optional peer — install it only if you need to convert templates to MJML. The two common cases are:
editor.toMjml() to export from the user's session.npm install @templatical/renderer
If you call editor.toMjml() without the renderer installed, it throws a clear error naming the missing package.
import { init } from '@templatical/editor';
import '@templatical/editor/style.css';
const editor = await init({
container: '#editor',
onChange(content) {
// content is JSON — store/version/sync however you want
},
});
// Render to MJML when sending email — async; requires @templatical/renderer
const mjml = await editor.toMjml();
// Always unmount when removing the editor (cleans up listeners + DOM)
editor.unmount();
<div id="editor" style="height: 100vh"></div>
First-class examples for React, Vue, Svelte, Angular, and vanilla JS are in the installation guide.
The editor mounts inside an open shadow root attached to your container. Host page CSS — including resets like * { color: red !important } — cannot cascade into editor elements, and editor utility classes cannot leak out.
// Shadow DOM is on by default — no extra config
const editor = await init({ container: "#editor" });
// Opt out for light-DOM mount (older browsers, host-side document.querySelector access)
const editor = await init({ container: "#editor", shadowDom: false });
Theme via :host-style CSS variables — set --tpl-user-* on the container (or any ancestor) and the value inherits across the shadow boundary:
#editor {
--tpl-user-primary: oklch(65% 0.2 280);
--tpl-user-radius: 14px;
}
See the Shadow DOM guide for trade-offs, opt-out semantics, and browser-support tiers.
For AI rewrite, real-time collaboration, comments, snapshots, and saved modules, use initCloud() instead. See the Cloud guide.
Full docs at docs.templatical.com.
FSL-1.1-MIT — free for any non-competing commercial use, automatically converts to MIT after 2 years per release. License FAQ.
FAQs
Vue 3 visual drag-and-drop email editor powered by Templatical
The npm package @templatical/editor receives a total of 4,162 weekly downloads. As such, @templatical/editor popularity was classified as popular.
We found that @templatical/editor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.