
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Next generation web header UX. This is similar to headroom.js, but different in areas I believed could be improved:
Sites like medium.com, romper.com, teehan + lax deploy a similar technique
npm install headspace
// new Headspace(element, options)
// Basic example:
var headspace = new Headspace(document.querySelector('header'))
// Advanced example with options:
Headspace(document.querySelector('header'), { // can use factory method instead of `new`
startOffset: 90, // default: height of element
tolerance: 5, // default: 8
showAtBottom: false, // default: true
classNames: {
base: 'custom', // default: 'headspace'
fixed: 'custom--fixed', // default: 'headspace--fixed'
hidden: 'custom--hidden' // default: 'headspace--hidden'
}
})
Base css:
To get started quickly with the minimal amount of css, copy contents of dist/headspace.css to your project.
Out of the box: Chrome 24+, Firefox 23+, Safari 7+, IE 10+
Read: browsers that natively support classList and requestAnimationFrame
You can globally pollyfill them if needed, otherwise the code is structured so you can manually shim-in support.
Headroom.isSupported() will check if it can be used out of the box on the current browser/environment
npm run build
npm test
FAQs
Next generation web header UX
The npm package headspace receives a total of 12 weekly downloads. As such, headspace popularity was classified as not popular.
We found that headspace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.