
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
HTML template strings for the Browser with support for Server Side Rendering in Node.
HTML template strings for the Browser with support for Server Side Rendering in Node.
$ npm install nanohtml
var html = require('nanohtml')
var el = html`
<body>
<h1>Hello planet</h1>
</body>
`
document.body.appendChild(el)
Node doesn't have a DOM available. So in order to render HTML we use string concatenation instead. This has the fun benefit of being quite efficient, which in turn means it's great for server rendering!
var html = require('nanohtml')
var el = html`
<body>
<h1>Hello planet</h1>
</body>
`
console.log(el.toString())
Modules like jsdom implement (parts of)
the DOM in pure JavaScript. If you don't really need the performance of
string concatenation, or use nanohtml components that modify the raw DOM, use
nanohtml/dom to give nanohtml a custom Document.
var JSDOM = require('jsdom').JSDOM
var nanohtml = require('nanohtml/dom')
var jsdom = new JSDOM()
var html = nanohtml(jsdom.window.document)
var el = html`
<body>
<h1>Hello planet</h1>
</body>
`
el.appendChild(html`<p>A paragraph</p>`)
el.outerHTML === '<body><h1>Hello planet</h1><p>A paragraph</p></body>'
By default all content inside template strings is escaped. This is great for
strings, but not ideal if you want to insert HTML that's been returned from
another function (for example: a markdown renderer). Use nanohtml/raw for
to interpolate HTML directly.
var raw = require('nanohtml/raw')
var html = require('nanohtml')
var string = '<h1>This a regular string.</h1>'
var el = html`
<body>
${raw(string)}
</body>
`
document.body.appendChild(el)
var html = require('nanohtml')
var el = html`
<body>
<button onclick=${onclick}>
Click Me
</button>
</body>
`
document.body.appendChild(el)
function onclick (e) {
console.log(`${e.target} was clicked`)
}
If you have more than one root element they will be combined with a DocumentFragment.
var html = require('nanohtml')
var el = html`
<li>Chashu</li>
<li>Nori</li>
`
document.querySelector('ul').appendChild(el)
Parsing HTML has significant overhead. Being able to parse HTML statically, ahead of time can speed up rendering to be about twice as fast.
$ browserify -t nanohtml index.js > bundle.js
var browserify = require('browserify')
var nanohtml = require('nanohtml')
var path = require('path')
var b = browserify(path.join(__dirname, 'index.js'))
.transform(nanohtml)
b.bundle().pipe(process.stdout)
{
"name": "my-app",
"private": true,
"browserify": {
"transform": [
"nanohtml"
]
},
"dependencies": {
"nanohtml": "^1.0.0"
}
}
At the time of writing there's no Webpack loader yet. We'd love a contribution!
Add nanohtml to your .babelrc config.
Without options:
{
"plugins": [
"nanohtml"
]
}
With options:
{
"plugins": [
["nanohtml", {
"useImport": true
}]
]
}
useImport - Set to true to use import statements for injected modules.
By default, require is used.appendChildModule - Import path to a module that contains an appendChild
function. Defaults to "nanohtml/lib/append-child".Use the @rollup/plugin-commonjs plugin with @rollup/plugin-node-resolve. Explicitly import the browser or server entrypoint in your application. E.g.:
import html from 'nanohtml/lib/browser';
Shout out to Shama and Shuhei for their contributions to Bel, yo-yoify and pelo. This module is based on their work, and wouldn't have been possible otherwise!
FAQs
HTML template strings for the Browser with support for Server Side Rendering in Node.
The npm package nanohtml receives a total of 95,189 weekly downloads. As such, nanohtml popularity was classified as popular.
We found that nanohtml demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 27 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.