
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@weekwood/editorjs-attaches
Advanced tools
 # Attaches Tool Attaches Tool for the [Editor.js](https://codex.so/editor).
Attaches Tool for the Editor.js.
This tool allows you to attach files to your articles.
You can get the package using any of these ways.
npm i --save-dev @editorjs/attaches
Include module at your application
const AttachesTool = require('@editorjs/attaches');
dist
from repositorydist/bundle.js
file to your page.You can load specific version of package from jsDelivr CDN.
https://cdn.jsdelivr.net/npm/@editorjs/attaches@latest
Then require this script on page with Editor.js through the <script src=""></script>
tag.
Add a new Tool to the tools
property of the Editor.js initial config.
var editor = EditorJS({
...
tools: {
...
attaches: {
class: AttachesTool,
config: {
endpoint: 'http://localhost:8008/uploadFile'
}
}
}
...
});
Attaches Tool supports these configuration parameters:
Field | Type | Description |
---|---|---|
endpoint | string | Required: endpoint for file uploading. |
field | string | (default: file ) Name of uploaded file field in POST request |
types | string | (default: * ) Mime-types of files that can be accepted with file selection. |
buttonText | string | (default: Select file ) Placeholder for file upload button |
errorMessage | string | (default: File upload failed ) Message to show if file upload failed |
This Tool returns data
with following format
Field | Type | Description |
---|---|---|
file | object | Uploaded file data. Data received from backend uploader. See description below. |
title | string | File's title. Initially set as uploaded file name. Can be modified by user. |
Object file
consists of the following fields. All of them are optional, size
and extension
are supported by design.
Field | Type | Description |
---|---|---|
url | string | Full public path of uploaded file |
size | number | File's size (expected in bytes, according to Tool's design) |
name | string | File's name |
extension | string | File's extension |
{
"type" : "attaches",
"data" : {
"file": {
"url" : "https://www.tesla.com/tesla_theme/assets/img/_vehicle_redesign/roadster_and_semi/roadster/hero.jpg",
"size": 91,
"name": "hero.jpg",
"extension": "jpg"
},
"title": "Hero"
}
}
Response of your uploader should cover following format:
{
"success" : 1,
"file": {
// any data you want
// for example: url, name, size
}
}
success - uploading status. 1 for successful, 0 for failed
file - uploaded file data.
Can contain data you want to store. Fields url
, name
, size
, and extension
if present will be written to file object. Fields size and extension are supported by design.
FAQs
 # Attaches Tool Attaches Tool for the [Editor.js](https://codex.so/editor).
The npm package @weekwood/editorjs-attaches receives a total of 0 weekly downloads. As such, @weekwood/editorjs-attaches popularity was classified as not popular.
We found that @weekwood/editorjs-attaches demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.