
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
frame-worker
Advanced tools
Run Web Worker Script with an IFrame
<script src="https://unpkg.com/frame-worker"></script>
npm install frame-worker
import FrameWorker from "frame-worker";
// initialize from url
new FrameWorker("./square.worker.js");
// intialize from blob url
new FrameWorker("blob:http://localhost:8080/bf331630-1275-4b3d-9b65-22512egdb592");
// initialize from data url
new FrameWorker("data:application/javascript;base64,Cm1vZHVsZS5leHBvcnRzLmRlZmF1bHQgPSBmdW5jdGlvbigpIHsKICByZXR1cm4gMTIzNDsKfQ==");
// listen to messages
worker.addEventListener("message", function (event) {
console.log("received": event.data);
});
You can pass an extra context object to the worker. FrameWorker will assign the entries in the object
to the global window and self inside the iframe. In the example below, we pass a validate function
to the FrameWorker.
new FrameWorker(workerScript, undefined, {
context: {
validate: function() { ... }
}
});
You can pass in a CommonJS module and have it automatically interpreted as a Web Worker script.
If there is no self.onmessage defined in the input script, FrameWorker will automatically look for and call module.exports or module.exports.default function.
const code = `
module.exports = function() {
return 1234;
}
`;
new FrameWorker(code, undefined, {
cjs: true, // code is a basic CommonJS file
raw: true // code is not encoded in a Data URL or Blob URL
});
You can set debug to true for extra helpful log messages
new FrameWorker(workerScript, undefined, { debug: true });
You can specify an id to give to the created iframe. If id is not a string, it will be ignored.
new FrameWorker(workerScript, undefined, { id: "special" });
You can pass in raw unencoded JavaScript.
new FrameWorker("console.log('hello, world')", undefined, { raw: true });
If you initialize a FrameWorker with a "blob:..." url,
you can have the url automatically revoked after the worker is initialized.
const url = "blob:http://localhost:8080/bf331630-1275-4b3d-9b65-22512egdb592";
new FrameWorker(url, undefined, { revoke: true });
FAQs
Run Worker Script inside an Iframe
We found that frame-worker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.