
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
enter-view
Advanced tools
Dependency-free JavaScript library to detect when element enters into view. See demo. It uses requestAnimationFrame in favor of scroll events for less jank. Less than 1kb minified + gzipped.
Old school (exposes the enterView
global):
<script src="https://unpkg.com/enter-view"></script>
New school:
npm install enter-view --save
And then import/require it:
import enterView from 'enter-view'; // or...
const enterView = require('enterView');
enterView({
selector: '.class-name',
enter: function(el) {
el.classList.add('entered');
}
});
enterView({
selector: '.class-name',
enter: function(el) {
el.classList.add('entered');
},
exit: function(el) {
el.classList.remove('entered');
},
progress: function(el, progress) {
el.style.opacity = progress;
},
offset: 0.5, // enter at middle of viewport
once: true, // trigger just once
});
Takes a class, id, or array of dom elements.
Callback function that returns the element that was entered.
Callback function that returns the element that was exited.
Callback function that returns the element that was progressed through, and a value between 0 and 1 of how far through the element progress has been made.
A value from 0 to 1 of how far from the bottom of the viewport to offset the trigger by. 0 = top of element crosses bottom of viewport (enters screen from bottom), 1 = top of element crosses top of viewport (exits screen top).
Whether or not to trigger the callback just once.
FAQs
Dependency-free JavaScript library to detect when element enters into view
The npm package enter-view receives a total of 945 weekly downloads. As such, enter-view popularity was classified as not popular.
We found that enter-view demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.