Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
pepjs-offset
Advanced tools
PEP polyfills pointer events in all browsers that haven't yet implemented them, providing a unified, responsive input model for all devices and input types. You can read more about pointer events below.
<script src="https://code.jquery.com/pep/0.4.3/pep.js"></script>
By default, no pointer events are sent from an element. This maximizes the possibility that a browser can deliver smooth scrolling and jank-free gestures. If you want to receive events, you must set the touch-action
property of that element. Set up some elements to create events with the touch-action
attribute.
Listen for the desired events
pointermove
: a pointer moves, similar to touchmove or mousemove.pointerdown
: a pointer is activated, or a device button held.pointerup
: a pointer is deactivated, or a device button released.pointerover
: a pointer has moved onto an element.pointerout
: a pointer is no longer on an element it once was.pointerenter
: a pointer enters the bounding box of an element.pointerleave
: a pointer leaves the bounding box of an element.pointercancel
: a pointer will no longer generate events.touch-action
attribute changed, they will send the proper set of pointer events.<html lang="en">
<head>
<meta charset="utf-8">
<title>PEP (Pointer Events Polyfill)</title>
<meta name="viewport" content="width=device-width">
<!-- include PEP -->
<script src="https://code.jquery.com/pep/0.4.3/pep.js"></script>
</head>
<body>
<button id="b" touch-action="none">Test button!</button>
<p><output id="o"></output></p>
<script>
document.getElementById( "b" ).addEventListener( "pointerdown", function( e ) {
document.getElementById( "o" ).innerHTML = "that was a " +
e.pointerType + " " + e.type + " on a "+ e.target.nodeName;
} );
</script>
</body>
</html>
See also the examples in the W3C Pointer Events Specification and our own samples for using PEP.
You can use pointer events with jQuery and PEP:
<div id="canvas" touch-action="none"></div>
<script src="pep.dist.js"></script>
<script src="jquery.js"></script>
<script>
$("#canvas").on("pointermove", function(event) {
draw(event);
});
</script>
Check out this jsbin demo for a full demo.
jQuery doesn't copy all properties from the original event object to the event object provided in the event handler. You can find a list of copied and normalized properties on the jQuery API docs. To access any other original properties, use event.originalEvent
.
React doesn't support Pointer Events or touch-action
natively, but check out the <Pointable/> component on npm for a declarative way of integrating PEP / Pointer Events into a React project.
Mouse events and touch events are fundamentally different beasts in browsers today, and that makes it hard to write cross-platform apps.
For example, a simple finger paint app needs plenty of work to behave correctly with mouse and touch:
Current platforms that implement touch events also provide mouse events for backward compatibility; however, only a subset of mouse events are fired and the semantics are changed.
click
event handler. One must be attached by default, or directly on the element with onclick
.click
events are not fired if the content of the page changes in a mousemove
or mouseover
event.click
events are fired 300ms after the touch sequence ends.Additionally, touch events are sent only to the element that received the touchstart
. This is fundamentally different than mouse events, which fire on the element that is under the mouse. To make them behave similarly, touch events need to be retargeted with document.elementFromPoint
.
These incompatibilities lead to applications having to listen to 2 sets of events, mouse on desktop and touch for mobile.
This forked interaction experience is cumbersome and hard to maintain.
Instead, there should exist a set of events that are normalized such that they behave exactly the same, no matter the source: touch, mouse, stylus, skull implant, etc. To do this right, this normalized event system needs to be available for all the web platform to use.
Thus, Pointer Events!
According to the spec, the touch-action CSS property controls whether an element will perform a "default action" such as scrolling, or receive a continuous stream of pointer events.
Due to the difficult nature of polyfilling new CSS properties, this library uses a touch-action attribute instead. For PEP to work correctly, you will therefore need to include touch-action="..."
attributes in your HTML that mirror any touch-action:...
properties you have in your CSS.
<style>
div#foo { touch-action: none; }
</style>
...
<div id="foo" touch-action="none"> ... </div>
Run time changes involving the touch-action
attribute are monitored using Mutation Observers for maximum flexibility.
Touches will not generate events unless inside of an area that has a valid touch-action
attribute defined. This is to maintain composition scrolling optimizations where possible.
PEP does not currently polyfill the capturing phase for pointer events.
As the information necessary to populate navigator.maxTouchPoints
is not available in browsers that do not natively implement pointer events, PEP sets the value to 0
, which is "the minimum number guaranteed to be recognized" as required by the specification.
PEP should work on IE 10+ and the latest versions of Chrome, Safari, Firefox, and Opera. In any browser implementing pointer events natively (detected by checking for window.PointerEvent
), PEP won't do anything.
If you want to build PEP yourself from source, you'll need to install Node.js and run the following commands:
# Install all dependencies
npm install
# Build PEP
npm run build
When the build completes, the generated files will be available in the dist/
directory.
NOTE: Running the demos requires building PEP.
FAQs
Polyfill of the PointerEvents W3C spec
The npm package pepjs-offset receives a total of 1 weekly downloads. As such, pepjs-offset popularity was classified as not popular.
We found that pepjs-offset demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.