
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@vcl/coarse-pointer
Advanced tools
Optimizations for coarse pointing devices such as touch based input devices
Optimizations for coarse pointing devices such as touch based input devices.
Optimizations:
This demonstrates the optional mq4-hover-shim
feature of the VCL preprocessor.
In this case, a small JS snipped adds a vclHoverSupport prefix container
wrapping the first button, if the devices supports hovering.
If so, the button's background color will be bright green when hovered.
If not, the button will have no hover effect. This is desired behavior
especially on mobile devices to prevent buttons keeping their hover effect
after they have been activated once (many mobile platforms maintain :hover
as if it were :focus). The VCL's button component prevents this by using
the @media (hover: none) media feature media query as can be seen with the
second button. Because not all browsers support this, the hover shim can be used
to emulate this. The detection of the hover support in this example is a simple
list user agent names found on touch devices.
Note: The demo currently does not run withing the demo browser, therefore, the cdynamic parts of the code are shown below.
<script>
setTimeout(addClass, 100);
function addClass() {
// logic copied from mq4-hover-shim.js
supportsTrueHover = !/Opera Mini|Android|IEMobile|Windows (Phone|CE)|(XBL|Zune)WP7/.test(
navigator.userAgent
);
const prefixContainer = document.getElementById(
'prefixContainer'
);
const detectionResultTag = document.getElementById(
'detectionResult'
);
if (supportsTrueHover) {
prefixContainer.className = 'vclHoverSupport';
}
detectionResultTag.innerHTML = supportsTrueHover
? 'Your device supports hovering'
: 'Your Device does not support hovering';
}
</script>
<style>
.vclHoverSupport .vclButton:hover {
background-color: #0f0;
color: #FFFFFF;
}
</style>
example.html on GH-pages.
FAQs
Optimizations for coarse pointing devices such as touch based input devices
We found that @vcl/coarse-pointer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.