Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@webref/events
Advanced tools
This package contains a consolidated list of events defined across specs, scraped from the latest versions of web platform specifications in webref, along with the name of the Web IDL interfaces that these events use and target. Fixes are applied to ensure that guarantees hold.
The async listAll()
method resolves with a list of events. Example:
const events = require('@webref/events');
events.listAll().then(all => {
for (const event of all) {
// do something with the json object that describes the event
}
});
Each event is described by an object with the following properties:
type
: contains the name of the eventinterface
: describes the IDL interface used by the eventtargets
: lists the target interfaces on which the event may fire. Each target in the list is an object with a target
property that gives the interface name, a bubbles
property only set when the interface belongs to a bubbling tree to assert whether the event bubbles, and a bubblingPath
property only when the event effectively bubbles and that lists the core interfaces on which the event can theoretically bubble.href
property that is a URL to the event definition in a specsrc
property that describes where the extraction first detected that the event is fired in the specThe following example illustrates access to main properties:
const events = require('@webref/events');
events.listAll().then(all => {
for (const event of all) {
console.log();
console.log(`Event type=${event.type}
interface=${event.interface}
targets=${event.targets
.map(t => t.target +
(t.bubbles === undefined ? '' : ` (bubbles: ${t.bubbles})`))
.join(', ')}`);
}
});
Actual interfaces on which an event will bubble may be interfaces that inherit from the interfaces listed in bubblingPath
. For instance, for a bubbling event that fires on HTMLSelectElement
, the bubbling path will be ["Node", "Document", "Window"]
, even though the event will only bubble on HTMLElement
and not on all types of Node
in practice.
The following guarantees are provided by this package:
type
attribute that match the name of the eventinterface
attribute to describe the interface used by the Event. The Web IDL interface exists in the latest version of the @webref/idl
package at the time the @webref/events
package is released, and represents an actual interface (i.e. not a mixin).targets
attribute with a non-empty list of target interfaces on which the event may fire. All Web IDL interfaces in the list exist in the latest version of the @webref/idl
package at the time the @webref/events
package is released, and represent an actual interface (i.e. not a mixin).bubbles
attribute is always set to a boolean value for target interfaces that belong to a bubbling tree (DOM, IndexedDB, Serial API, Web Bluetooth).bubbles
attribute is only set for target interfaces that belong to a bubbling tree.bubblingPath
attribute is only set for target interfaces on which the event bubbles.targets
attribute contains the top most interfaces in an inheritance chain, unless bubbling conditions differ. For instance, the list may contain { "target": "Element", "bubbles": true }
but not also { "target": "HTMLElement", "bubbles": true }
since HTMLElement
inherits from Element
.targets
attribute only contains the deepest interface in the bubbling tree on which the event may fire and bubble. For instance, the list may contain { "target": "HTMLElement", "bubbles": true }
, but not also { "target": "Document" }
since event would de facto fire at Document
through bubbling.FAQs
Events of the Web platform and associated Web IDL interfaces
The npm package @webref/events receives a total of 184 weekly downloads. As such, @webref/events popularity was classified as not popular.
We found that @webref/events demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.