Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
:dart: A web-components html5 video player facing future.
目前 web-components 原生支持度是在太差,尤其是国内各种奇葩浏览器(搜狗、QQ 等),需要引入 polyfill
值得一提,dist 目录下,.b
后缀为浏览器文件,作为 cdn 使用
<script src="https://unpkg.com/@webcomponents/webcomponentsjs@2.2.1/webcomponents-bundle.js"></script>
<script src="./eplayer.b.js"></script>
e-player
标签,没错,只需要将平时用的 video
换成 e-player
即可type 属性可选,默认为 mp4
<e-player src="./001.mp4"></e-player>
e-player {
/* 主题色 默认为哔哩哔哩同款蓝*/
--theme: #f13e7b;
/* 进度条底色 一般不用设置 */
--progress: rgba(255, 255, 255, 0.3);
/* 进度条偏移颜色 一般不用设置 */
--buffer: rgba(255, 255, 255, 0.3);
/* 图标颜色 一般不用设置 */
--icons: rgba(255, 255, 255, 0.6);
}
原生支持 mp4
和 mkv
,如果需要支持 m3u8
和 flv
,需要先引入 hls.js
这两个文件太大,建议手动 gzip
<script src="./hlv.min.js"></script>
已经放弃 flv
的支持,太古老的格式,兼容性极差
npm i eplayer --save
注意,发布到 npm 的模块,只对外暴露了一个 Eplayer 类,需要自行 define customElements,并且是全局注册,只能注册一次
impport Eplayer from 'eplayer'
customElements.define('e-player',Eplayer)
同样的,polyfill 和 hls.js 等仍然以 cdn 的方式加入
这还没完,接着看:
vue 默认是不支持 web-components 的,它无法主动判断含有-
的是 vue 组件还是 web 组件
所以需要手动配置,忽略掉e-player
Vue.config.ignoredElements = [
'e-player'
]
然后,同样需要引入上面的几个文件,然后 bind 一下 src 和 type
<e-player :src="url" :type="type"></e-player>
可以封装成 vue 组件来使用:vue-web-components-wrapper
react 直接支持 web-components,直接在 render 函数中e-player
标签
同样的,JSX 并不把它当作 vnode tree 的孩子,需要手动操作 dom
通常为了方便的使用 ref,会封装成 react 组件来使用:
function Eplayer(props) {
return <e-player src={props.src} type={props.type}></e-player>
}
ssr 服务端没有 web-components 的 API,通常 web-components 的 ssr 都会通过一些库去模拟这些 API eplayer 不推荐这么做,请直接和正常的 html 引入方式一样,引入 cdn
关于移动端,国产的手机浏览器太奇葩,没有好的兼容方法
目前会自动检测,移动端会自动替换为默认播放器,然后浏览器会自动替换 UI
FAQs
A web-components html5 video player facing future
The npm package eplayer receives a total of 194 weekly downloads. As such, eplayer popularity was classified as not popular.
We found that eplayer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.