
Security News
MCP Community Begins Work on Official MCP Metaregistry
The MCP community is launching an official registry to standardize AI tool discovery and let agents dynamically find and install MCP servers.
Cross-origin iframe messenger.
npm i coframe
coframe
is designed for TypeScript, though of course TS is optional. Basic
usage looks like this, just be sure your iframe
is fully loaded in the
browser. Note the separate files.
// https://parent.com/index.js
import { connect } from "coframe";
const parent = connect(document.getElementById("my-iframe"));
parent.emit("init");
// https://child.com/index.js
import { listen } from "coframe";
const child = listen();
child.on("init", (data) => {
// do something
});
By default, coframe
assumes a single connection. To enable multiple
connections to the same iframe, and/or to enhance security, pass a connection
name when creating a connection or listener.
This will ensure that events from other coframe instances do not interfere with
yours. Plus, after establishing a connection, coframe
will ignore events from any
source other than the source that established that connection.
import { connect, listen } from "coframe";
const parent = connect(iframe, "my-connection");
const child = listen("my-connection");
coframe
really shines when used with TypeScript because it allows you to
strictly type the events and payloads sent between windows. To do so, you'll
need a shared type interface that can be included in the compiled bundles of
both the parent and child windows.
Here, each key of the type corresponds to an event name, and each value
corresponds to the payload of that event. For events with no payload, specify
undefined
.
type InitPayload = {
name: string;
date: string;
};
export type Events = {
init: InitPayload;
open: undefined;
close: undefined;
};
Usage then looks very similar, but you'll get strict type checking in dev.
// https://parent.com/index.js
import { connect } from "coframe";
import { Events } from "./shared/events";
const parent = connect<Events>(document.getElementById("my-iframe"));
parent.emit("init", {
name: "Truework",
date: new Date(), // TypeError
});
parent.emit("open");
// https://child.com/index.js
import { listen } from "coframe";
import { Events } from "./shared/events";
const child = listen<Events>();
child.on("init", ({ name, date }) => {}); // strictly typed parameters!
child.on("open", () => {});
MIT License © Truework
FAQs
Cross-origin iframe messenger.
We found that coframe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The MCP community is launching an official registry to standardize AI tool discovery and let agents dynamically find and install MCP servers.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.