
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
aframe-post-message-component
Advanced tools
A simple component that reads a JSON object from the Post Message API or from the URL Parameters and fires an event. A common usage scenario would be to update the applications state.
For A-Frame.
This component listes to events from the element and redirects the event detail via postMessage to its parent window. So it only works if the whole A-Frame scene is embedded within an IFrame. The format of the posted message is {type: '', event: '', data: {}}, where the type property is the type and the event as in the schema and the data is the events detail object.
| Property | Description | Default Value |
|---|---|---|
| enabled | Listen to events and send data as a post message to its parent window | AFRAME.utils.isIframed |
| type | The type name of the post message for the parent to identify | |
| event | Event name to listen and redirect as a post message | loaded |
Must be attached to the scene entity.
The sent data in the postMessage is opionated by this library and must be of the format {type: '', event: '', data: {}} whereas the event property is optional. The type property must correspond with the type given in the components configuration.
| Property | Description | Default Value |
|---|---|---|
| enabled | Listen to postMessage events | true |
| type | The type name of the Post Message data to be check | |
| defaultEvent | Event name to be fired when the received postMessage has no event property | messagePosted |
Must be attached to the scene entity.
The URL parameter is in the form ¶meter={} whereas the parameter name is defined by the schema and defaults to message
| Property | Description | Default Value |
|---|---|---|
| enabled | Read URL GET Parameters once when the scene is loaded | true |
| parameter | Query parameter key name to recognize message from | message |
| defaultEvent | Event name to be fired when the received message has no event property | messagePosted |
Install and use by directly including the browser files:
<head>
<title>My A-Frame Scene</title>
<script src="https://aframe.io/releases/0.6.0/aframe.min.js"></script>
<script src="https://unpkg.com/aframe-post-message-component/dist/aframe-post-message-component.min.js"></script>
</head>
<body>
<a-scene post-message listen-message url-parameter>
</a-scene>
</body>
Install via npm:
npm install aframe-post-message-component
Then require and use.
require('aframe');
require('aframe-post-message-component');
FAQs
An optionated postMessage component for A-Frame.
We found that aframe-post-message-component demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.