
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
kb-controls
Advanced tools
expose a polling object for (game) keybindings using vkey definitions.
var kb = require('./index')
, raf = require('raf')
var ctl = kb({
'<left>': 'strafe_left'
, '<right>': 'strafe_right'
, '<up>': 'forward'
, '<down>': 'backward'
, 'W': 'forward'
, 'A': 'strafe_left'
, 'S': 'backward'
, 'D': 'strafe_right'
, '<mouse 1>': 'fire'
})
raf(document.body).on('data', function(dt) {
console.log(!!ctl.forward)
})
Events are great! I love them. But when you're writing game logic, oftentimes you want the frame event to drive the simulation -- and dealing with the keyboard as a separate evented interface can be troublesome in this regard.
return the kb function.
Add event listeners to DOMElement or document.body if not provided.
Bindings is a map of vkey's to desired property names:
// bindings example
{ 'X': 'do_something'
, '<space>': 'jump'
, '<control>': 'sprint' }
// would yield the following ctl object (sans methods):
{ 'do_something': 0
, 'jump': 0
, 'sprint': 0 }
If augmentObject is passed, these property names will be attached to it instead
of a new object.
If the number is truthy, that means it's actively being pressed. Otherwise it's not. If it's greater than 1, then two different keys may have been bound to the action and are simultaneously being pressed.
Enables the keyup, keydown, mouseup, and mousedown listeners (and makes them preventDefault().)
Returns whether or not the ctl is enabled.
Disables the DOM listeners (without removing them). Keyboard and mouse events should work
as normal while the ctl is disabled.
Removes all DOM event listeners and renders the ctl inert.
MIT
FAQs
present a polling interface for keyboard state given a binding object
The npm package kb-controls receives a total of 114 weekly downloads. As such, kb-controls popularity was classified as not popular.
We found that kb-controls demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.