
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Artemon javascript library for embedding augmented reality artworks. Sign up at app.artemon.io.
Artemon is a javascript library for embedding augmented reality artwork previews.
An account with Artemon is required in order to create the experiences viewed using this library. Create an account at app.artemon.io.
Use npm package manager to install artemon.
npm i artemon
Loading the module
// CommonJS module require
const artemon = require('artemon');
// ES2015 module import
import artemon from 'artemon';
Replace id with your unique id or leave blank if using path workflow.
artemon.init('id');
Replace id with your unique id or null if using path workflow.
Replace container_id with id of container HTMLElement or the element reference itself.
artemon.init('id', 'container_id');
Replace id with your unique id or leave blank if using path workflow.
The error object (if present) means that the experience was not found.
artemon.getExperience('id')
.then(experience => {
if(!experience.error) document.querySelector('button').onclick = () => experience.start();
})
We have created a simple wrapper example for usage in ReactJS.
import artemon from './artemon-min.js';
import ReactDOM from 'react-dom';
import React, { Component, createRef } from 'react';
export class Artemon extends Component {
wrapper = createRef();
render() {
return <div ref={this.wrapper}/>;
}
componentDidMount() {
const node = this.wrapper.current;
artemon.init(this.props.id ? this.props.id : null, node);
ReactDOM.render(<React.Fragment>{this.props.children}</React.Fragment>, node);
}
componentWillUnmount() {
artemon.clear(this.props.id ? this.props.id : null);
}
}
To use the wrapper, pass an id (if using the ID workflow) to the reactjs component or leave it blank, if using the URL workflow.
import { Artemon } from './Artemon';
function App() {
return (
<div className="App">
<Artemon id="ID"></Artemon>
</div>
);
}
export default App;
Artemon button created by init() can be customized in two ways.
The variables object sets globals for artemon design. For more direct control, you can use the individual objects, e.g. startButton, stopButton etc.
This properties object will have to be provided as the third parameter for artemon.init() or artemon.start(). For artemon.getExperience() the properties object will have to be provided for the returned experience.start() function.
const prop = {
variables: {
paper: "white", // ...........any valid CSS color
button: "transparent", // ....any valid CSS color
buttonText: "black", // ......any valid CSS color
font: "Roboto", // ...........any available font
border: "1px solid black", // any valid CSS border value
borderRadius: "4px", // ......any valid CSS border-radius value
ripple: "black", // ..........any valid CSS color | "off"
buttonIcon: "black" // .......any valid CSS color | "off"
}
startButton: {
text: "mybutton",
style: {
default: {
color: "red"
},
hover: {...},
active: {...}
}
},
stopButton: {...},
helpButton: {...},
ripple: "white",
loader: {...},
fallbackHelp: {...},
xrHelp: {...},
qr: {...}
}
artemon.init('id', null, prop);
Due to our shadowroot mode being open, you are free to create your own style tags and append them to the shadowRoot.
artemon.init(...)
.then(viewer => {
const style = document.createElement('style');
style.innerHTML = ".artemon-button { background-color: black; color: white; }";
viewer.shadowRoot.appendChild(style);
})
| Selector | Description |
|---|---|
| .artemon-button | All non-floating and non-icon buttons |
| .artemon-button--start | Start button |
| .artemon-button--stop | Stop button |
| .artemon-button--floating | Floating button |
| .artemon-icon-button | Icon button |
| .artemon-icon | Icon button icon |
| .artemon-loader | Loader |
| .artemon-loader--graphics | Loader wrapper |
| .artemon-loader--circular | Loader svg |
| .artemon-loader--path | Loader circle |
| .artemon-help | Help screen |
| .artemon-canvas | Webgl canvas |
| .artemon-guide | XR guide |
| .artemon-guide--tracking | XR tracking guide |
| .artemon-guide--placing | XR placing guide |
| .artemon-qr | QR |
| .artemon-qr--qrcode | QR code |
| .artemon-qr--details | QR Details wrapper |
| .artemon-qr--details-icon | QR Details icon |
| .artemon-qr--details-text | QR Details text |
This library needs content (experiences) to be created beforehand. This library is only for embedding said experiences into your website.
Content creation options:
You can reach us either via chat on our homepage or via email at info@artemon.io.
Copyright © 2021 Operose Labs, LTD - See LICENSE.md for more information <info@operose.io>. For third party license information, see artemon-min.js.licenses.txt.
FAQs
Artemon javascript library for embedding augmented reality artworks. Sign up at app.artemon.io.
The npm package artemon receives a total of 1 weekly downloads. As such, artemon popularity was classified as not popular.
We found that artemon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.