
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
JSON for the Web — a tiny declarative frontend framework using pure JSON to describe your UI, events, and behavior.
jsonftw is a minimal web framework that renders your application UI using only JSON definitions. It supports:
onClick)It’s perfect for building visual editors, low-code platforms, documentation UIs, or any project where UI should be data-defined.
To use jsonftw in a project:
npm install jsonftw # Install
npx jsonftw@latest # Scaffold new project using JSONFTW
<!DOCTYPE html>
<html lang="en">
<head>
<title>jsonftw App</title>
</head>
<body>
<div id="app"></div>
<script type="module" src="./main.js"></script>
</body>
</html>
// main.js
import { startJsonFTW } from "jsonftw";
startJsonFTW();
routes/home.json file{
"cssFile": "styles.css",
"renderOn": "app",
"view": [
{
"type": "div",
"identifier": "container",
"class": "wrapper"
},
{
"type": "h1",
"identifier": "main-title",
"innerText": "Welcome to jsonftw",
"insideOf": {
"childElement": true,
"parentElement": "container"
}
},
{
"type": "button",
"identifier": "click-button",
"innerText": "Click Me",
"onClick": "alert('Hello from jsonftw!');",
"insideOf": {
"childElement": true,
"parentElement": "container"
}
}
],
"javascript": "console.log('Page loaded');"
}
<a href="#/">Home</a> <a href="#/about">About</a>
Each route is a .json file with the following structure:
| Field | Type | Required | Description |
|---|---|---|---|
cssFile | string | optional | Path to an external stylesheet to load |
renderOn | string | optional | DOM id to render into (default: app) |
view | array | ✅ | A list of DOM element definitions |
javascript | string | optional | Page-level inline JavaScript to run after render |
view[])| Field | Type | Required | Description |
|---|---|---|---|
type | string | ✅ | HTML element tag (e.g., div, h1, input) |
identifier | string | ✅ | Unique key used internally for nesting |
class | string | optional | class attribute |
id | string | optional | id attribute |
style | string | optional | Inline style (e.g., "color: red;") |
innerText | string | optional | Text content |
value | string | optional | For input elements |
src | string | optional | For img, video, iframe, etc. |
href | string | optional | For a tags |
placeholder | string | optional | For inputs |
onClick | string | optional | Inline JS for click handler |
insideOf | object | optional | Nest inside a parent element ({ childElement: true, parentElement: "id" }) |
Given the JSON:
{
"view": [
{
"type": "div",
"identifier": "wrapper"
},
{
"type": "h1",
"innerText": "Hello World",
"identifier": "title",
"insideOf": { "childElement": true, "parentElement": "wrapper" }
}
]
}
Output DOM:
<div data-identifier="wrapper">
<h1 data-identifier="title">Hello World</h1>
</div>
Set a cssFile in your route JSON and it will be <link>-injected into <head> if not already loaded.
Uses window.location.hash to route to routes/<page>.json.
Examples:
#/ → routes/home.json#/about → routes/about.jsonYou can include a string of JS in:
onClickjavascript (top-level)It will be evaluated using new Function(...).
my-app/
├── index.html
├── main.js
├── routes/
│ └── home.json
├── styles.css
├── node_modules/
└── package.json
MIT — free to use and modify.
Feel free to open issues or PRs! jsonftw is built to be hackable and extendable.
FAQs
A minimal JSON-first web UI framework.
We found that jsonftw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.