
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
Helps setting up editable components in ProseMirror, with non-editable parts and named content with configurable schema.
Use coed
to augment the editor with stylable DOM components and customizable
form inputs.
It comes pre-bundled with a "link" component that makes use of url-inspector for insertion as resource, embed, or anchors.
Simply add dist/coed.min.css, dist/coed.min.js to a web page and initialize the editor:
document.addEventListener('DOMContentLoaded', function() {
function inspectorCallback(info, cb) {
// info is mutable
var node = info.fragment && info.fragment.firstChild;
if (node && node.nodeName == "IFRAME") {
info.title = info.url = node.src;
}
// url-inspector-daemon@1.5.0 has right properties names
GET("https://inspector.eda.sarl/inspector", {
url: info.url
}, cb);
}
var coed = new Coed({
place: "#editor", // can also be a DOM Node
components: [Coed.link]
}, {
link: {
inspector: inspectorCallback
}
});
var domContent = document.querySelector("#content");
coed.set(domContent);
domContent.hidden = true;
});
External usage
component.from
by returning block data.Internal usage
insert
.block-content
attribute name.withoutContent
boolean argument prevents it from collecting contents.selection
parameter is a prosemirror's Selection instance.
coed instance conveniently exposes underlying prosemirror editor modules: Menu, Commands, State, Transform, Model, Pos (from dompos), keymap.
A block is an object representing a component instance. It is not explicitely
used by coed
but its the main concept of the editor.
A block is
Coed options.
Coed global variable stores some useful default values:
coed.set
A component is a class that exposes the static properties and instance methods defined below.
A component must add itself to Coed.components array and create it if it is missing:
if (!global.Coed) global.Coed = { components: [] };
global.Coed.components.push(CoLink);
Options are passed to component instances in the second argument of Coed constructor.
a component prototype must have default values for the properties
A component instance must also call
coed.refresh(dom)
when something else than the editor changed its DOM.
do not confuse root dom node attributes and component data
block-content
attribute.content[name]
is the node having the block-content
attribute.A component representing a resource of any kind (url or fragment).
Plugin options:
An inspector
async function that receives an object with either url or fragment,
mutable properties.
Setting immediately the title
property on that object will set the title of the
loading block, and the callback should receive the properties listed above
(which have the same format as url-inspector result).
The properties returned by that function are then used to render the DOM node,
parse it and insert it into the edited document.
Coed.spec
is the schema specification that will be used to
initialize ProseMirror, and Coed.plugins
, the list of prosemirror plugins
needed by Coed.
These options are passed to ProseMirror constructor:
FAQs
Editor with Components
The npm package coed receives a total of 1 weekly downloads. As such, coed popularity was classified as not popular.
We found that coed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.