
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
a readable stream of mouse view events, wrapping up pointer-lock and drag-stream
A wrapper module that provides a drag-stream fallback for pointer-lock.
Handles the requestFullScreen pointer lock requirement of firefox.
var interact = require('interact')
interact(document.body)
.on('attain', function(stream) {
// stream attained! it'll emit "move"
// events with {dx, dy, dt} attributes.
// it also has an `initial` member with `{x, y, t}`
// marking the start position and start time.
// it's readable, and it'll clean up after itself.
})
.on('release', function() {
// stream has been released -- either the user
// left pointer-lock, or stopped dragging.
})
.on('opt-out', function() {
// user opted out of pointer lock,
// and will be using drag-stream instead.
// you can use this event to record a preference
// in localStorage.
})
sets a click listener on element that requests pointerLock (if skipLock is false and
pointerlock is available) on click. if the lock is declined (politely!) it'll switch to
drag-stream-style events.
forwards these commands to the internal handler (whether that be pointer-lock or drag-stream)
if a corresponding method exists.
returns whether or not pointer lock is available -- forwards from require('pointer-lock').available().
returns whether or not fullscreen is available -- forwards from require('fullscreen').available().
the initial position for streams.
a stream of movement data is ready for consumption.
stream is a readable stream that closes appropriately, so you don't have to clean up after it.
stream.initial has {x: int, y: int, t: timestamp int} members detailing the initial position
and time of the stream.
stream's data events are in the form of {dx: int, dy: int, dt: timedelta int}.
when in drag-stream mode, these'll be emitted every time there's a mousedown on the target element.
in pointer-lock mode, it'll be emitted every time the user enters pointer lock -- that is to say, a lot less often.
the last stream has been released. you shouldn't really have to do anything here -- the
stream will clean up after itself (it emits close and end events).
emitted when the requestPointerLock is declined by the user. use this to store a preference
to send into interact later down the line!
interact(el, localStorage.getItem('no-pointer-lock'))
.on('opt-out', function() {
localStorage.setItem('no-pointer-lock', true)
})
MIT
FAQs
a readable stream of mouse view events, wrapping up pointer-lock and drag-stream
The npm package interact receives a total of 184 weekly downloads. As such, interact popularity was classified as not popular.
We found that interact demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.