Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
<co-editor>
is a web component for real-time collaborative text editing. It maintains consistent document states between collaborating users with operational transformation. All of this logic is handled by the component in client-side, so the application developer only needs to broadcast the updates from each client to the others.
Simulating 5000ms network delay between two collaborating clients:
(see index.html
for the example code)
npm install
npm run start
Open localhost:8080
.
Run the demo server and open localhost:8080/test
.
npm install
npm run build
This produces a minified bundle at /dist/co-editor.min.js
Web components are reusable custom HTML elements which encapsulate their content and styles inside a shadow DOM.
See https://developer.mozilla.org/en-US/docs/Web/Web_Components.
The component maintains consistent document states between collaborating users by implementing the GOTO algorithm (General Operational Transformation Optimized), based on research work by Chengzheng Sun et al.
[1] C. Sun, X. Jia, Y. Zhang, Y. Yang, and D. Chen,
“Achieving convergence, causality preservation, and intention preservation in
real-time cooperative editing systems”, ACM Trans. Comput. -Hum. Interact.,
vol. 5, no. 1, pp. 63–108, Mar. 1998.
[2] C. Sun and C. Ellis,
“Operational transformation in real-time group editors: Issues, algorithms,
and achievements”, in Proceedings of the 1998 ACM Conferenceon Computer Supported
Cooperative Work, ser. CSCW ’98, Seattle, Washington, USA: ACM, 1998, pp. 59–68.
FAQs
A web component for real-time collaborative text editing
The npm package co-editor receives a total of 1 weekly downloads. As such, co-editor popularity was classified as not popular.
We found that co-editor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.