
Research
Malicious Go “crypto” Module Steals Passwords and Deploys Rekoobe Backdoor
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.
A tiny (less than 512 byte) template engine that uses virtual DOM and some of react principles
A tiny (512 byte) virtual DOM template engine for embedded projects
IE / Edge | Firefox | Chrome | Safari | Opera | iOS Safari | Chrome for Android |
|---|---|---|---|---|---|---|
| Edge 14+ | 45+ | 49+ | 10+ | 37+ | 10.2+ | 55+ |
.dom borrows some concepts from React.js (such as the re-usable Components and the Virtual DOM) and tries to replicate them with the smallest possible footprint, exploiting the ES6 javascript features.
Why? Because with such library you can create powerful GUIs in tight space environments, such as IoT devices, where saving even an extra byte actually matters!
Tiny by design : The library should never exceed the 512 bytes in size. The goal is not to have yet another template engine, but to have as many features as possible in 512 bytes. If a new feature is needed, an other must be sacraficed or the scope must be reduced.
Built for the future : The library is heavily exploiting the ES6 specifications, meaning that it's not supported by older browsers. Currently it's supported by the 70% of the browsers in the market, but expect this to be 90% within the next year.
Declarative : Describe your HTML DOM in a structured, natural manner, helping you create powerful yet readable user interfaces.
Component-Oriented : Just like React.js, .dom promotes the use of functional components.
"Write less" accelerators : The library API is designed specifically to have short function names and accelerators, allowing you to describe your views with less code.
For minimum footprint, include dotdom.min.js.gz (512b) to your project.
<script src="dotdom.min.js.gz" />
Alternatively you can just include the minified version of the library directly before your script. Just copy-paste the minified code.
If you already know React.js, the following examples can help you understand how the .dom primitives relate to React.
Rendering a very simple DOM structure.
| React | .dom |
|---|---|
ReactDOM.render(
React.createElement('div', null, 'Hello world'),
document.body
);
|
R(
H('div', 'Hello world'),
document.body
)
|
Creating a component on which you can pass properties.
| React | .dom |
|---|---|
function Hello(props) {
return React.createElement(
'div', null, `Hello ${props.toWhat}`
);
}
|
function Hello(props) {
return H('div', `Hello ${props.toWhat}`);
}
|
Creating components that can maintain their own state.
| React | .dom |
|---|---|
class Clickable extends React.Component {
constructor() {
super(...arguments);
this.state = {
clicks: 0
};
}
|
function Clickable(props, state, setState) {
const {clicks=0} = state;
|
The component can also subscribe to life-cycle events:
| React | .dom |
|---|---|
class WithLifeCycle extends React.Component {
constructor() {
super(...arguments);
this.state = {
mounted: "no"
};
}
|
function WithLifeCycle(props, state, setState, hooks) {
const {mounted = "no"} = state;
hooks.m.push(() => {
setState({ mounted: "yes" })
});
|
R( VNode, DOMElement )R( H('div', 'Hello'), document.body )
Renders the given VNode tree to the given DOM element. Further updates from stateful components will only occur on their immediate children.
H( tagName | function, [properties], [children ...])H( 'tag' )
H( 'tag', {prop: "value"})
H( 'tag', H( 'child' ))
H( 'tag', {prop: "value"}, H( 'child' ))
H( Component, {prop: "value"} )
Creates a VNode element. If a string is passed as the first argument, it will create a HTML element. If a function is given, it will create a stateful component.
Properties and children are optional and they can be omitted.
Instead of a tag name you can provide a function that returns a Virtual DOM according to some higher-level logic. Such function have the following signature:
const Component = (props, state, setState, hooks) {
// Return your Virtual DOM
return div( ... )
}
The props property contains the properties object as given when the component
was created.
The state is initialized to an empty object {} and it's updated by calling
the setState({ newState }) method. The latter will also trigger an update to
the component and it's children.
You can also assign properties to the state object directly if you don't want
to cause an update.
The hooks object can be used when you want to register handlers to the component life-cycle methods.
Similar to React, the .dom components have a life-cycle:
To access the life-cycle methods you need to use the fourth argument on your component function. More specifically you have to push your handling function in either of the following fields:
const Component = (props, state, setState, hooks) {
hooks.m.push((domElement) => {
// '.m' is called when the component is mounted
});
hooks.u.push(() => {
// `.u` is called when the component is unmounted
});
hooks.d.push((domElement, previousDomElement) => {
// `.d` is called when the component is updated
});
...
}
tag( [properties], [children ...] )const {div, span, a} = H;
div( 'hello', span( 'world' ) )
div( 'click', a({href: '#'}, 'Here'), 'to continue')
A shorthand function can be extracted as a property from the H function. Such
shorthands behave exactly like H, but with the tag name already populated.
It's recommended to use a deconstructuring assignment in the beginning of your script in order to help javascript minifiers further optimize the result:
const {div, span, a, button} = H;
tag.class( [properties], [children ...] )const {h1, span, p} = H;
h1.short( 'short header', span.strong( 'strong text' ) )
button.primary({onclick: handleClick}, 'Primary Action')
p.bold.italic( twitterPost )
Instead of providing the className as a property, you can use the .className shorthand in combination with the shorthand tag methods.
This is the same as calling div({className: 'className'}) and the function interface is exactly the same as above.
Note: You can add more than one class by concatenating more than one .class to the tag. For example: div.foo.bar is the same as div({className: 'foo bar'}).
Since the project's focus is the small size, it is lacking sanity checks. This makes it susceptible to errors. Be very careful with the following caveats:
You cannot trigger an update with a property removal. You must set the new property to an empty value instead. For example:
// Wrong
R(div({className: 'foo'}), document.body);
R(div({}), document.body);
// Correct
R(div({className: 'foo'}), document.body);
R(div({className: ''}), document.body);
You must never use a property named $ in your components. Doing so, will make the property object to be considered as a Virtual DOM Node and will lead to unexpected results.
// *NEVER* do this!
R(H(MyComponent, {$: 'Foo'}), document.body)
Are you interested in contributing to .dom? You are more than welcome! Just be sure to follow the guidelines:
npm install
npm test && npm run build && ls -l dotdom.min.js.gz
If tests pass and the size of dotdom.min.js.gz is smaller than or equal to 512 bytes, create a pull request. Otherwise reduce your scope or think of another implementation in order to bring it back down to 512 bytes.
Make sure to properly comments your code, since you will most probably have to do some extreme javascript hacking. The gudeliens are the following:
/**
* Functions are commented as JSDoc blocks
*
* @param {VNode|Array<VNode>} vnodes - The node on an array of nodes to render
* ...
*/
global.R = render = (
vnodes, // Flat-code comments start on column 70 and
dom, // wrap after column 120.
/* Logical separations can be commented like this */
...
Licensed under the Apache License, Version 2.0
FAQs
A tiny (less than 512 byte) template engine that uses virtual DOM and some of react principles
The npm package dot-dom receives a total of 19 weekly downloads. As such, dot-dom popularity was classified as not popular.
We found that dot-dom demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Security News
npm rolls out a package release cooldown and scalable trusted publishing updates as ecosystem adoption of install safeguards grows.

Security News
AI agents are writing more code than ever, and that's creating new supply chain risks. Feross joins the Risky Business Podcast to break down what that means for open source security.