
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
lazercursor
Advanced tools
A smooth, physics-driven custom cursor inspired by osu!lazer. Framework-agnostic core + React adapter.
npm install lazercursor
import { LazerCursorProvider } from "lazercursor/react"
import "lazercursor/styles/cursor.css"
function App() {
return (
<LazerCursorProvider>
<YourApp />
</LazerCursorProvider>
)
}
import { LazerCursorEngine } from "lazercursor"
import "lazercursor/styles/cursor.css"
const el = document.createElement("div")
el.className = "starcursor-cursor"
document.body.appendChild(el)
new LazerCursorEngine(el, { useDamping: true, followerTauMs: 80 })
When creating the engine, you can pass an options object:
useDamping: boolean
Enable smooth cursor damping (default: true).
If set to false, the custom cursor will instantly follow the system cursor with no smoothing.
followerTauMs: number
Damping strength in milliseconds (default: 60).
Larger values → more “laggy” and elastic movement.
Smaller values → cursor catches up faster.
Example:
new LazerCursorEngine(el, {
useDamping: true, // enable smooth damping
followerTauMs: 100 // stronger "lag"
})
This library is designed for visual experiments, games, and demos — not for production websites. By default, it intercepts some browser behaviors in order to achieve a smooth cursor effect:
contextmenu event is prevented).dragstart is prevented).Because of these restrictions, this cursor is not suitable for content-heavy or production apps where users rely on right-click menus, drag & drop, or accessibility features.
✅ Suitable for:
🚫 Not suitable for:
MIT © ZackMount
FAQs
A smooth, physics-driven custom cursor inspired by osu!lazer.
The npm package lazercursor receives a total of 0 weekly downloads. As such, lazercursor popularity was classified as not popular.
We found that lazercursor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.