Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Domm is a small library to create safe HTML and DOM nodes using ES6 template literals.
It's lightweight and relies on native JS functionality. For anything non-trivial, this doesn't compete with a real template language like pug, or a library like react.
npm install --save domm
const D = require('domm');
D.html`<h1>Hello World!</h1>`;
// => '<h1>Hello World!</h1>'
D.dom`<h1>Hello World!</h1>`;
// => new instance of <HTMLHeadingElement>
D.dom`
<a href="/">Home</a>
<a href="/about">About</a>
`;
// => new instance of <NodeList> containing 2 links
// String
const headingText = 'Houses';
// Object
const headingAttrs = { class: 'heading-main' };
// Array
const names = ['Lannister', 'Stark', 'Tyrell'];
// Element
const backLink = document.querySelector('.js-link-back');
D.html`
<div>
<h1 ${headingAttrs}>${headingText}</h1>
<ul>
${names.map(names => D.html`<li>${name}</li>`)}
</ul>
${backLink}
</div>
`;
// =>
// <div>
// <h1 class="heading-main">Houses</h1>
// <ul>
// <li>Lannister</li><li>Stark</li><li>Tyrell</li>
// </ul>
// <a class="js-link-back" href="/">Back to home</a>
// </div>
Note that the list of names required D.html
to be used on the inner template literal. Without this, the HTML in the list would have been escaped:
"<li>Lannister</li><li>Stark</li><li>Tyrell</li>"
All strings that are interpolated are escaped in this way. To dangerously escape a variable that is not defined via a template literal, use the D
constructor:
const title = someExternalFunctionForGettingTitle();
D.dom`<h1>${new D(title)}</h1>`;
FAQs
Template literal tags for creating DOM nodes.
The npm package domm receives a total of 1 weekly downloads. As such, domm popularity was classified as not popular.
We found that domm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.