
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
matrix-widget-api
Advanced tools
JavaScript/TypeScript SDK for widgets & clients to communicate.
For help and support, visit #matrix-widgets:matrix.org on Matrix.
This is currently not validated and thus should not be relied upon until this notice goes away. Installation instructions will take this notice's place.
If you're looking to drop the widget-api into a web browser without the use of a bundler, add a script
tag similar to the following:
<script src="https://unpkg.com/matrix-widget-api@0.1.0/dist/api.min.js"></script>
Note that the version number may need changing to match the current release.
Once included, the widget-api will be available under mxwidgets
. For example, new mxwidgets.WidgetApi(...)
to instantiate the WidgetApi
class.
The general usage for this would be:
const widgetId = null; // if you know the widget ID, supply it.
const api = new WidgetApi(widgetId);
// Before doing anything else, request capabilities:
api.requestCapability(MatrixCapabilities.Screenshots);
api.requestCapabilities(StickerpickerCapabilities);
// Add custom action handlers (if needed)
api.on(`action:${WidgetApiToWidgetAction.UpdateVisibility}`, (ev: CustomEvent<IVisibilityActionRequest>) => {
ev.preventDefault(); // we're handling it, so stop the widget API from doing something.
console.log(ev.detail); // custom handling here
api.transport.reply(ev.detail, <IWidgetApiRequestEmptyData>{});
});
api.on("action:com.example.my_action", (ev: CustomEvent<ICustomActionRequest>) => {
ev.preventDefault(); // we're handling it, so stop the widget API from doing something.
console.log(ev.detail); // custom handling here
api.transport.reply(ev.detail, {custom: "reply"});
});
// Start the messaging
api.start();
// If waitForIframeLoad is false, tell the client that we're good to go
api.sendContentLoaded();
// Later, do something else (if needed)
api.setAlwaysOnScreen(true);
api.transport.send("com.example.my_action", {isExample: true});
For a more complete example, see the examples
directory of this repo.
This SDK is meant for use in browser-based applications. The concepts may be transferable to other platforms, though currently this SDK is intended to only be used by browsers. In the future it may be possible for this SDK to provide an interface for other platforms.
TODO: Improve this
const driver = new CustomDriver(); // an implementation of WidgetDriver
const api = new ClientWidgetApi(widget, iframe, driver);
// The API is automatically started, so we just have to wait for a ready before doing something
api.on("ready", () => {
api.updateVisibility(true).then(() => console.log("Widget knows it is visible now"));
api.transport.send("com.example.my_action", {isExample: true});
});
// Eventually, stop the API handling
api.stop();
FAQs
Matrix Widget API SDK
We found that matrix-widget-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.