Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
aria-live-capture
Advanced tools
Installation | Usage | Announcement detection examples | Support
Capture announcements of ARIA live regions.
aria-live-capture
is an utility tool for inspecting announcements of ARIA live regions.
When developing an application which utilizes ARIA live announcements it is often frustrating to toggle screen readers and other assistive technologies constantly on/off during development.
This tool aims to help developers easily see announcements without having to use actual screen readers.
However final assertion should always be made with the actual target assistive technology.
For online demo see Storybook playground.
For validating ARIA live regions in tests see extend-to-be-announced
.
For Storybook integration see storybook-addon-aria-live
.
Read more about inspiration from Building testing tools for ARIA live regions.
aria-live-capture
should be included in development dependencies.
npm install --save-dev aria-live-capture
Import CaptureAnnouncements
from entrypoint.
import CaptureAnnouncements from 'aria-live-capture';
Pass onCapture
callback to handle announcements.
Callback argument | type | value |
---|---|---|
announcement | string | Text content of the announcement |
politenessSetting | string | polite|assertive |
CaptureAnnouncements({
onCapture: (announcement, politenessSetting) => {
console.log(`"${announcement}" was announced with politeness setting "${politenessSetting}"`);
},
});
"Loading" was announced with politeness setting "polite"
"Failed to load user details" was announced with politeness setting "assertive"
Pass an optional boolean includeShadowDom
option to include tracking of live regions in Shadow DOM.
Default value is false
.
CaptureAnnouncements({
includeShadowDom: true,
});
The CaptureAnnouncements
method returns cleanup
function for clearing DOM interceptors.
const cleanup = CaptureAnnouncements(options);
cleanup();
Render#1 | <div role="status"></div>
Render#2 | <div role="status">Loading</div>
PASS ✅ | "Loading" is announced
Render#1 | <div aria-live="polite"></div>
Render#2 | <div aria-live="polite">Loading</div>
PASS ✅ | "Loading" is announced
Render#1 | <div role="log"></div>
Render#2 | <div role="log">Loading</div>
PASS ✅ | "Loading" is announced
Render#1 | <output></output>
Render#2 | <output>Loading</output>
PASS ✅ | "Loading" is announced
Render#1 | <div role="status">Loading</div>
FAIL ❌ | "Loading" is not announced
Render#1 | <div></div>
Render#2 | <div role="status">Loading</div>
FAIL ❌ | "Loading" is not announced
Render#1 | <div></div>
Render#2 | <div aria-live="polite">Loading</div>
FAIL ❌ | "Loading" is not announced
Render#1 | <div role="alert">Error</div>
PASS ✅ | "Error" is announced
Render#1 | <div aria-live="assertive">Error</div>
FAIL ❌ | "Error" is not announced
Render#1 | <div></div>
Render#2 | <div role="alert">Error</div>
PASS ✅ | "Error" is announced
Render#1 | <div role="status">
| <div aria-hidden="true">Loading</div>
| </div>
|
Render#2 | <div role="status">
| <div aria-hidden="false">Loading</div>
| </div>
|
PASS ✅ | "Loading" is announced
Render#1 | <div role="status" aria-hidden="true">Loading</div>
Render#2 | <div role="status" aria-hidden="false">Loading</div>
FAIL ❌ | "Loading" is not announced
With option { includeShadowDom: true }
:
Render#1 | <div role="status">
| #shadow-root
| <div></div>
| </div>
|
Render#2 | <div role="status">
| #shadow-root
| <div>Loading</div>
| </div>
|
PASS ✅ | "Loading" is announced
Feature | Status |
---|---|
role | ✅ |
aria-live | ✅ |
aria-atomic | ❌ 👷 |
aria-busy | ❌ |
aria-relevant | ❌ |
FAQs
Capture announcements of ARIA-live regions
We found that aria-live-capture demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.