
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
vanilla popup / dialog library.
install with npm:
npm install ldcover
include required files ( index.js and index.css ), and create a ldcover object:
var ldcv = new ldcover({ ... });
root: container.
template tag as root for better performance during initialization. The first child in the template will be used as the real root for this ldcover.type: additional class to add. default: ''. space seprated.transform-fix: true/false. default: false.
add a 'shown' class after ldcover is shown, which removes transform from .inner block.
useful when content is blurred due to transform, but might lead to glitches when doing transition. use it carefully.delay: milliseconds. default 300. should be aligned with transition duration. use to control 'shown' and 'running' classes.autoZ: update root's z-index automatically. default true.baseZ: the minimal z-index of root. default 3000.
zmgr: set z-index manager for this cover.
baseZ will be used to call zmgr, which set a lower bound of z-index.
set baseZ to 0 for zmgr to correct work with lower values.animation: optional space separated class list.
escape: should pressing escape key close the dialog. boolean, default true, optional.lock: default false. if set to true, only API or data-ldcv-set could close this modal.resident: default false. if set to true, DOM for this cover will always attached under document. otherwise false.
container or document.body.inPlace: default true. if set to false, root will be removed from original parent and re-added under body.container: container for non-resident cover. by default parent of DOM or document.body
container to change this behavior.
container is null, root is appended at the end of document.body when toggled.rootis appended at the end of container when toggled.toggle(state, data): toggle on/off ldcover.
data: optional parameter, which will be sent in data event.
get(data): toggle on ldcover and return a promise, which will only be resolved when ldcover.set is called.
data: see toggle above.set(v, hide=true): set value, which resolve promises from get, and hide ldcover if hide = true.
data-ldcv-set on elements to automatically set value when elements are clicked.cancel(err, hide=true): reject promise returned by get with given error err.
Error object with {name: 'lderror', id: 999} will be used if err is omitted.hide = true. true by default.data-ldcv-cancel on elements to automatically cancel when clicked.on(event, cb): listen to certain event. evnets:
toggle.on: when ldcover is toggled on. may fired before shown.toggle.off: when ldcover is toggled off. may fired before hidden.toggled.on: when ldcover is toggled on. fired after shown.toggled.off: when ldcover is toggled off. fired after hidden.isOn(): is this modal active ( opened ). return true or falselock(): lock this cover. ( can't be dismissed by escaping )
data-lock="true" attribute to cover root.root(): get cover root node.zmgr(mgr): set z-index manager for this cover. return the zmgr used if mgr is omitted.
baseZ will be used to call zmgr, which set a lower bound of z-index.
set baseZ to 0 for zmgr to correct work with lower values.append(node): insert node in the base node of this cover.
destroy(opt): object destroyer. opt is an option object with following fields:
removeNode: should ldcover remove DOM of this cover. default false
removeNode to true.zmgr(zmgr): set a shared z-index manager. useful to manager widget z-index globally.
this manager should provide following methods:
add(baseVal, size): return actual added value.
remove(val): remove val ( returned by add ) from this manager.as described above, baseZ will be used to call zmgr, which set a lower bound of z-index.
set baseZ to 0 in ldcover instance so zmgr can work correclty with lower values.
A simple ldcover popup are built with following html structure:
one can decorate ldcover widgets by adding classes over the outmost element. following classes are defined by default:
.ldcv.bare:
.ldcv.lg, .ldcv.md
.ldcv.full - fullscreen modal.
.ldcv.full-sm, .ldcv.full-md, .ldcv.full-lg - conditional fullscreen modal. break point:
sm: < 576pxmd: < 768pxlg: < 960px.ldcv.light - light overlay bk
.ldcv.mini - non-blocking, float style dialog with following position available:
.ldcv.inline - inline cover. Won't affect local layout
centering
.ldcv.scroll:
scroll class on the ldcv node when you expect the modal content to longer than a screen's height. It makes the modal scrollable by users..ldcv.autogap:
autogap class on the ldcv node to automatically adjust cover padding and margin along with responsive scenario, with two additional classes:.outer-gap: only apply margin style. Used alone without autogap.autogap.nested-gap: apply padding style in nested div. Used along with autogapalternative transition
Simple popup could be configured with automatically set invocation to resolve promises waited by get. use data-ldcv-set attribute on elements to indicate what values to be passed into set:
<div class="ldcv">
<button data-ldcv-set="1"> OK </button>
<button data-ldcv-set="0"> Cancel </button>
</div>
use get function to wait for the return value:
ldcv.get!then -> if it == "1" => "OK" else "Cancel"
MIT
FAQs
tiny popup / dialog library
The npm package ldcover receives a total of 8 weekly downloads. As such, ldcover popularity was classified as not popular.
We found that ldcover demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.