
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
Clippy2 is a very simple Flash widget that makes it possible to place arbitrary text onto the client's clipboard. Clippy2 could be looks like:

This is a refactored fork of Clippy with enhanced functionality:
Passing the text to copy via HTML-attribute (which could be modified anytime you want), instead of as a flashvar (which passed into Flash only once on loading). This allows to use Clippy2 with frameworks like AngularJS.
Added possibility to copy text by calling a JavaScript callback window.clippyTextGetter()
This allows for increased flexibility in retrieving the data to copy,
e.g. if the text to be clipped is lengthy.
Download latest stable release, unzip and put it
to your public directory or wherever your static assets can be found. Then use it in your project
depending on cases described below.
Here is a sample HTML snippet that can be used to place Clippy2 button on a page:
<object clippy-text="{text-to-copy}" id="clippy-id" height="14" width="14" classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000">
<param name="movie" value="path/to/clippy2.swf">
<param name="allowScriptAccess" value="always">
<param name="quality" value="high">
<param name="scale" value="exactfit">
<param name="wmode" value="transparent">
<param name="flashVars" value="">
<embed name="clippy-id" src="path/to/clippy2.swf" height="14" width="14" flashVars="" allowscriptaccess="always" quality="high" scale="exactfit" wmode="transparent" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash">
</object>
Use clippy-text attribute for placing text to copy. This attribute could be changed anytime you want
with plain javascript document.getElementById('clippy-id').setAttribute('clippy-text', 'New text to copy')
or jQuery $('#clippy-id').attr('clippy-text', 'New text to copy')
Make sure that you have the same values for id-attribute in tag and name-attribute in tag.
Remember that id-attribute should be unique across page. So, in case you use several Clippy2 buttons on page, take care for this.
For disabling embedded icon just set noIcon=true as value for flashVars attribute and parameter. You will get transparent flash buton and its width and height could be modified.
In case window.clippyTextGetter() function is defined, it will be called with clicked Flash object id as argument.
window.clippyTextGetter = function(id) {
// Determining which button was clicked.
if (id === 'clippy-id-1') {
// Returned text will be copied to clipboard
return 'text-to-copy-for-specified-button'
}
// Empty string will be copied to clopboard (clearing buffer)
return '';
// DOM object could be accessed.
var obj = document.getElementById(id);
// Clippy2 will act by default, as if clippyTextGetter() was not defined
return null;
return undefined;
}
In order to compile Clippy2 from source, you need to install the haXe 3.
The haXe code is in clippy2.hx, the button images are in assets,
javascript code executing on button click is in clippy2.js
and the compiler config is in clippy2.hxml. Make sure you look at all of these to
see where and what you'll need to modify. To compile everything into a final
SWF, run the following from Clippy2 root directory:
> haxe clippy2.hxml
If that is successful, use compiled clippy2.swf.
FAQs
Copy text to clipboard with javascript and flash
The npm package clippy2 receives a total of 3 weekly downloads. As such, clippy2 popularity was classified as not popular.
We found that clippy2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.