Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@theolive/player
Advanced tools
This package contains the video player to play back THEOlive streams on your web page. It's intended for THEOlive customers that want to host the player themselves.
Install using your favorite package manager for Node (such as npm
or yarn
):
npm install @theolive/player
This example assumes you have created an account and your first channel and your channel is up and running.
This is a minimal page that creates a THEOLivePlayer
:
<!DOCTYPE html>
<html lang="en">
<head>
<title>Example</title>
<script type="text/javascript" src="THEOLive.js"></script>
</head>
<body>
<div id="player"></div>
<script type="text/javascript">
// Check if the player needs a service worker and register it if needed.
// THEOLive.sw.js needs to be served on the same path as this HTML page
if (THEOLive.requiresServiceWorker()) {
navigator.serviceWorker.register("THEOLive.sw.js")
}
// Create the player.
const player = new THEOLive.Player(document.getElementById('player'));
// play your stream
player.loadChannel('<your-channel-id>')
</script>
</body>
</html>
Make sure to change <your-channel-id>
with your actual channel-id
.
For more information, please visit the THEOlive documentation website: https://developers.theo.live/docs
FAQs
The official THEOlive video player.
The npm package @theolive/player receives a total of 48 weekly downloads. As such, @theolive/player popularity was classified as not popular.
We found that @theolive/player demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.