
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
electron-window
Advanced tools
Convenience methods for Electron windows.
npm i --save electron-window
electron-window converts this:
const {
app,
BrowserWindow
} = require('electron')
const path = require('path')
const url = require('url')
// Keep a global reference of the window object, if you don't, the window will
// be closed automatically when the javascript object is GCed.
let mainWindow = null
app.on('ready', () => {
mainWindow = new BrowserWindow({ width: 1000, height: 400, show: false })
const someArgs = { data: 'hi' }
const indexPath = path.resolve(__dirname, '..', 'weird-location', 'index.html')
const indexUrl = url.format({
protocol: 'file',
pathname: indexPath,
slashes: true,
hash: encodeURIComponent(JSON.stringify(someArgs))
})
mainWindow.on('closed', () => {
mainWindow = null
})
mainWindow.webContents.on('did-finish-load', () => {
mainWindow.show()
console.log('window is now visible!')
})
mainWindow.loadUrl(indexUrl)
})
to this:
const { app } = require('electron')
const path = require('path')
const window = require('electron-window')
app.on('ready', () => {
const mainWindow = window.createWindow({ width: 1000, height: 400 })
const someArgs = { data: 'hi' }
const indexPath = path.resolve(__dirname, '..', 'weird-location', 'index.html')
mainWindow.showUrl(indexPath, someArgs, () => {
console.log('window is now visible!')
})
})
Class method that creates a new BrowserWindow with
the following default options: { show: false }. No need to worry about keeping a global reference
to prevent garbage collection, this is handled for you.
Instance method to parse arguments in window. You would only need to call from your renderer preload script if you pass in
preload.
Instance method that shows the url. When the url is finished loading, the callback is returned. If the optional argsForRenderer is set
then __args__ will be a global object for the page in the renderer process. This is a convenient way to pass
arguments from the main process to the renderer process.
Instance method to call if you ever want to remove the global reference. Should only need to be called if
destroy() is ever called.
Most likely, you won't need to use this.
Class property to get a reference to all windows created and their ids. This is in the form of an object where the keys are window ids, and the values are instances of BrowserWindow.
main process
const window = require('electron-window')
const windowOptions = {
width: 1000,
height: 400
}
const mainWindow = window.createWindow(windowOptions)
// can access at window.__args__ from scripts
// ran from index.html
const args = {
data: 'some secret data'
}
mainWindow.showUrl('index.html', args, () => {
console.log('the window should be showing with the contents of the URL now')
})
renderer process
// only call if `preload` is set in `windowOptions`
require('electron-window').parseArgs()
console.log(window.__args__)
// => Object {data: "some secret data"}
MIT
FAQs
Convenience methods for Electron windows.
We found that electron-window demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.