
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
A light-weight JS library to lazy load any HTML element such as images, ads, videos etc.
Highly performant, light ~0.5kb and configurable lazy loader in pure JS with no dependencies for images, iframes and more, using IntersectionObserver API
Lozad.js:
It is written with an aim to lazy load images, iframes, ads, videos or any other element using the recently added Intersection Observer API with tremendous performance benefits.
Existing lazy loading libraries hook up to the scroll event or use a periodic timer and call getBoundingClientRect()
on elements that need to be lazy loaded. This approach, however, is painfully slow as each call to getBoundingClientRect()
forces the browser to re-layout the entire page and will introduce considerable jank to your website.
Making this more efficient and performant is what IntersectionObserver is designed for, and it’s landed in Chrome 51. IntersectionObservers let you know when an observed element enters or exits the browser’s viewport.
# You can install lozad with npm
$ npm install --save lozad
# Alternatively you can use Yarn.
$ yarn add lozad
# Another option is to use Bower.
$ bower install lozad
Then with a module bundler like rollup or webpack, use as you would anything else:
// using ES6 modules
import lozad from 'lozad'
// using CommonJS modules
var lozad = require('lozad')
Or load via CDN and include in the head
tag of your page.
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lozad/dist/lozad.js"></script>
or
<script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lozad/dist/lozad.min.js"></script>
When loading from CDN, you can find the library on window.lozad
.
In HTML, add an identifier to the element (default selector identified is lozad
class):
<img class="lozad" data-src="image.png" />
All you need to do now is just instantiate Lozad as follows:
const observer = lozad(); // lazy loads elements with default selector as '.lozad'
observer.observe();
or with custom options:
const observer = lozad('.lozad', {
rootMargin: '10px 0px', // syntax similar to that of CSS Margin
threshold: 0.1 // ratio of element convergence
});
observer.observe();
Reference:
or if you want to give custom function definition to load element:
lozad('.lozad', {
load: function(el) {
console.log('loading element');
// Custom implementation to load an element
// e.g. el.src = el.dataset.src;
}
});
If you want to lazy load dynamically added elements:
const observer = lozad();
observer.observe();
// ... code to dynamically add elements
observer.observe(); // observes newly added elements as well
Available in latest browsers. If browser support is not available, then make use of this polyfill.
Checkout the FAQ Wiki for some common gotchas to be aware of while using lozad.js
Interested in contributing features and fixes?
See the Changelog
FAQs
A light-weight JS library to lazy load any HTML element such as images, ads, videos etc.
The npm package lozad receives a total of 28,012 weekly downloads. As such, lozad popularity was classified as popular.
We found that lozad demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.