
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
fixed-sticky-module
Advanced tools
A position: sticky polyfill that works with filamentgroup/fixed-fixed for a safer position:fixed fallback.
A CSS position:sticky polyfill.
CSS position:sticky is really in its infancy in terms of browser support. In stock browsers, it is currently only available in iOS 6.
In Chrome you can enable it by navigating to Chrome temporarily removed their native chrome://flags and enabling experimental “WebKit features” or “Web Platform features” (Canary).position: sticky implementation.
In Firefox you you can go to about:config and set layout.css.sticky.enabled to "true".
The most overlooked thing about position: sticky is that sticky elements are constrained to the dimensions of their parent elements. This means if a sticky element is inside of a parent container that is the same dimensions as itself, the element will not stick.
Here’s an example of what a sticky element with CSS top: 20px behaves like:

Scrolling down. The blue border represents the dimensions of the parent container element. If the element’s top is greater than 20px to the top of the viewport, the element is not sticky.

Scrolling down. When the element’s top is less than 20px to the top of the viewport, the element is sticky.
Here’s an example of what a sticky element with CSS bottom: 20px behaves like:

Scrolling up. Not sticky.

Scrolling up. Sticky.
Just qualify element you’d like to be position:sticky with a fixedsticky class.
<div id="my-element" class="fixedsticky">
Add your own CSS to position the element. Supports any value for top or bottom.
.fixedsticky { top: 0; }
Next, add the events and initialize your sticky nodes:
$( '#my-element' ).fixedsticky();
Note: if you’re going to use non-zero values for top or bottom, fixed-sticky is victim to a cross-browser incompatibility with jQuery’s css method (namely, IE8- doesn’t normalize non-pixel values to pixels). Use pixels (or 0) for best cross-browser compatibility.
Optionally, you may also destroy the component:
$( '#my-element' ).fixedsticky( 'destroy' );
demo.html.demo-control.html.position: sticky Caveatsvisible) for overflow, overflow-x, or overflow-y on the parent element will disable position: sticky (via @davatron5000).position: sticky; with display: inline-block;.thead and tfoot.sticky anchors to parent elements using their own overflow. This means scrolling the element fixes the sticky element to the parent dimensions. This plugin does not support overflow on parent elements.If you’re having weird issues with native position: sticky, you can tell fixed-sticky to use the polyfill instead of native. Just override the sticky feature test to always return false. Make sure you do this before any calls to $( '#my-element' ).fixedsticky();.
// After fixed-sticky.js
FixedSticky.tests.sticky = false;
demo-opt-out-native.html shows this behavior.Use the provided fixedsticky.js and fixedsticky.css files.
This package is available in NPM for use with Browserify. First install the package.
npm install --save fixed-sticky-module
Then, require it and register it with your copy of jQuery.
var $ = require('jquery');
require('fixed-sticky')(window, $);
bower install filament-sticky
These tests were performed using fixed-sticky with fixed-fixed. It’s safest to use them together (position:fixed is a minefield on older devices), but they can be used independently.
v0.1.0: Initial release.v0.1.3: Bug fixes, rudimentary tests, destroy method.v0.2.0: Bug fixes, modules support.FAQs
A position: sticky polyfill that works with filamentgroup/fixed-fixed for a safer position:fixed fallback.
We found that fixed-sticky-module demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.