Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
balloon-css
Advanced tools
Balloon.css: Simple tooltips made of pure CSS.
Balloon.css lets you add tooltips to elements without JavaScript and in just a few lines of CSS.
It weights ~1.1kb minified (Brotli).
You can play with Balloon.css here: https://jsfiddle.net/kuzmd942/
You also can check more examples at the website: https://kazzkiq.github.io/balloon.css/
Using npm:
npm install balloon-css
You can then import the CSS file directly into your JS (using Webpack, etc):
// Your index.js file, etc.
import 'balloon-css';
or import the source file if using SASS/SCSS:
/* Your main.scss file, etc. */
@import "~balloon-css/src/balloon"
CDN version:
If you don't want to use npm, there is a CDN option:
<!-- This link will always fetch the latest version of Balloon.css -->
<link rel="stylesheet" href="https://unpkg.com/balloon-css/balloon.min.css">
Manually:
Simply download balloon.min.css
from this repo and add it to your HTML. e.g.
<link rel="stylesheet" href="path/to/balloon.min.css">
For positioning, use data-balloon-pos
attribute with one of the values: up
, down
, left
, right
, up-left
, up-right
, down-left
or down-right
:
<button aria-label="Whats up!" data-balloon-pos="up">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="left">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="right">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="down">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="up-left">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="up-right">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="down-left">Hover me!</button>
<button aria-label="Whats up!" data-balloon-pos="down-right">Hover me!</button>
If you want to show tooltips even when user interaction isn't happening, you can simply use the data-balloon-visible
attribute:
<button aria-label="Whats up!" data-balloon-pos="up" id="show-tip">Hover me!</button>
<script>
const btn = document.getElementById('show-tip')
btn.setAttribute('data-balloon-visible', '')
</script>
If for some reason you do not want animations in your tooltips, you can use the data-balloon-blunt
attribute for that.
<button data-balloon-blunt aria-label="No animation!" data-balloon-pos="up">No animation!</button>
Balloon.css exposes CSS variables to make it easier to customize tooltips:
--balloon-border-radius
--balloon-color
--balloon-font-size
--balloon-move
This way, you can use custom CSS to make your own tooltip styles:
/* Add this to your CSS */
.tooltip-red {
--balloon-color: red;
}
.tooltip-big-text {
--balloon-font-size: 20px;
}
.tooltip-slide {
--balloon-move: 30px;
}
If you want to customize tooltips globally, use the :root
selector:
/* All tooltips would now be square and blue */
:root {
--balloon-border-radius: 0;
--balloon-color: blue;
}
You can also add any HTML special character to your tooltips, or even use third-party Icon fonts:
<button aria-label="HTML special characters: ☻ ✂ ♜" data-balloon-pos="up">Hover me!</button>
<button aria-label="Emojis: 😀 😬 😁 😂 😃 😄 😅 😆" data-balloon-pos="up">Hover me!</button>
Example using Font Awesome:
<button class="fa" aria-label="Font Awesome:     " data-balloon-pos="up">Hover me!</button>
Balloon.css is mantained in SASS and LESS. To contribute with bugfixes and enchancements you must follow this steps:
git clone https://github.com/kazzkiq/balloon.css.git
npm install
npm run build
to generate the production CSS files.gh-pages
) before submitting a Pull Request.Note 1: Remember to update the SASS file instead of the generated ones (balloon.css
and balloon.min.css
are generated on every build from SASS file).
Made by Claudio Holanda (@kazzkiq)
FAQs
Simple tooltips made of pure CSS
The npm package balloon-css receives a total of 18,599 weekly downloads. As such, balloon-css popularity was classified as popular.
We found that balloon-css demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.