Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Cross-origin iframe messenger.
npm i coframe
coframe
is designed for TypeScript, though of course TS is optional. Basic
usage looks like this, just be sure your iframe
is fully loaded in the
browser. Note the separate files.
// https://parent.com/index.js
import { connect } from "coframe";
const parent = connect(document.getElementById("my-iframe"));
parent.emit("init");
// https://child.com/index.js
import { listen } from "coframe";
const child = listen();
child.on("init", (data) => {
// do something
});
By default, coframe
assumes a single connection. To enable multiple
connections to the same iframe, and/or to enhance security, pass a connection
name when creating a connection or listener.
This will ensure that events from other coframe instances do not interfere with
yours. Plus, after establishing a connection, coframe
will ignore events from any
source other than the source that established that connection.
import { connect, listen } from "coframe";
const parent = connect(iframe, "my-connection");
const child = listen("my-connection");
coframe
really shines when used with TypeScript because it allows you to
strictly type the events and payloads sent between windows. To do so, you'll
need a shared type interface that can be included in the compiled bundles of
both the parent and child windows.
Here, each key of the type corresponds to an event name, and each value
corresponds to the payload of that event. For events with no payload, specify
undefined
.
type InitPayload = {
name: string;
date: string;
};
export type Events = {
init: InitPayload;
open: undefined;
close: undefined;
};
Usage then looks very similar, but you'll get strict type checking in dev.
// https://parent.com/index.js
import { connect } from "coframe";
import { Events } from "./shared/events";
const parent = connect<Events>(document.getElementById("my-iframe"));
parent.emit("init", {
name: "Truework",
date: new Date(), // TypeError
});
parent.emit("open");
// https://child.com/index.js
import { listen } from "coframe";
import { Events } from "./shared/events";
const child = listen<Events>();
child.on("init", ({ name, date }) => {}); // strictly typed parameters!
child.on("open", () => {});
MIT License © Truework
FAQs
Cross-origin iframe messenger.
The npm package coframe receives a total of 19 weekly downloads. As such, coframe popularity was classified as not popular.
We found that coframe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.