
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
gravlift is a web application message courier.
import { create } from "./gravlift.js";
var gravlift = create();
gravlift.subscribeWith( {
"my::cool::custom-event": ( shuttle ) => {
let node = document.createElement( "div" );
node.textContent = shuttle.message;
document.getElementById( "global-alert-box" ).appendChild( node );
}
} );
// Later, in an application sub-module far, far away
afterRender(){
var gravlift = this.dependencyInjection.gravlift;
document
.getElementById( "our-very-critical-button" )
.addEventListener( "click", () => {
gravlift.publish( {
"name": "my::cool::custom-event",
"message": "Thank you for clicking our Very Important Button!"
} );
} );
}
An application can define a catalogue of named events that can occur, and those define the API boundaries of various sections of an application.
These standardized, common events are also multicast, which means - should another section of the application ever care about the click of the Very Important Button - the triggering location does not need to be modified in any way. Only the new component that cares needs to listen for the existing event, and react to it.
FAQs
gravlift is a web application message courier.
We found that gravlift demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.