
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
generator-cardboard
Advanced tools
Yeoman generator that scaffolds out a web app complete with a virtual reality environment built with THREE.js which is Google Cardboard compatible.
npm install -g generator-cardboard
yo cardboard
grunt
for building and grunt serve
for preview. --allow-remote
option for remote access.(HTML/CSS/JS/Images/etc)
Third-party dependencies are managed with grunt-wiredep. Add new dependencies using Bower and then run the Grunt task to load them:
$ bower install --save jquery
$ grunt wiredep
This works if the package author has followed the Bower spec. If the files are not automatically added to your source code, check with the package's repo for support and/or file an issue with them to have it updated.
To manually add dependencies, bower install --save depName
to get the files, then add a script
or style
tag to your index.html
or another appropriate place.
The components are installed in the root of the project at /bower_components
. To reference them from index.html, use src="bower_components"
or src="/bower_components"
. Treat the bower_components
directory as if it was a sibling to index.html
.
Testing Note: a project checked into source control and later checked out needs to have bower install
run from the test
folder as well as from the project root.
--skip-install
Skips the automatic execution of bower
and npm
after scaffolding has finished.
--test-framework=<framework>
Defaults to mocha
. Can be switched for another supported testing framework like jasmine
.
See the yeoman contributing docs.
FAQs
Scaffold out a web based Google cardboard VR experience
The npm package generator-cardboard receives a total of 1 weekly downloads. As such, generator-cardboard popularity was classified as not popular.
We found that generator-cardboard demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.