
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
lazyload-transform
Advanced tools
transform html to support the lazy loading of images clientside
IN DEVELOPMENT
Node package written in Go to transform html to support the lazy loading of images clientside
To install:
npm install --save lazyload-transform
yarn add lazyload-transform
To use:
const { Render } = require('lazyload-transform');
const html = '<html><head></head><body><img src="my-image.jpg"></body></html>';
const transformedHtml = Render(html);
console.log(transformedHtml);
// -> <html><head></head><body><img src="" data-src="my-image.jpg" class="lazyload-transform"><script>/*ClientSide JS Here...*/</script></body></html>
By default, lazyload-transform
will do 2 things:
img
tags, move the value of src
to data-src
style
attribute, move the first url to data-background-image
and replace with a single pixelOptions to control behavior will be in the next release.
To compare to cheerio, run node ./benchmark/cheerio
. This benchmark's cheerio implementation is a direct implementation of the functionality written in Go, following best practices from the cheerio documentation.
On a Intel(R) Core(TM) i5-8257U CPU @ 1.40GHz
this library is roughly 9-10x faster at parsing and manipulating 1494 lines of html.
LazyLoad Completed In: 7ms
Cheerio Completed In: 70ms
Requires libxml2
.
To test the go library run go test lazyload.go lazyload_test.go
.
To test the node wrapper run npm test
. Node wrapper should always be tested after updating go library.
To generate lazyload.h
and lazyload.a
required for the node binding, run go build -buildmode=c-archive -o lazyload.a lazyload.go
followed by node-gyp build
to update the bindings.
FAQs
transform html to support the lazy loading of images clientside
The npm package lazyload-transform receives a total of 2 weekly downloads. As such, lazyload-transform popularity was classified as not popular.
We found that lazyload-transform demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.