
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
pingboxjs is a JavaScript SDK that lets websites send real native mobile push notifications without building a native mobile app.
Instead of browser notifications, users install a single companion Android app once. After a one time device binding, any website using pingboxjs can send true native notifications that work even when the browser is closed.
The purpose of pingboxjs is simple. Enable native mobile notifications using only JavaScript.
To use pingboxjs you need an API key generated from the developer dashboard.
Run the dashboard locally or deploy it:
cd pingbox-dashboard
npm install
npm run dev
Open http://localhost:3000 in your browser and register your website to generate an API key.
The backend handles device binding and notification delivery and requires Firebase.
cd pingbox-backend
npm install
# place your firebase service account file in this folder
node server.js
By default the backend runs on http://localhost:3001.
Important. When testing on a real Android device, replace localhost with your computer local IP address.
The pingbox Android app must be built and installed manually.
cd pingboxapp
npm install
cd android && ./gradlew assembleRelease
The generated APK can be found at:
android/app/build/outputs/apk/release/app-release.apk
Install this APK on the Android device.
For local development, include the built SDK file:
<script src="/path/to/pingbox.min.js"></script>
When published to npm:
npm install pingboxjs
The SDK is used through the global pingbox object.
pingboxjs uses an init based API and does not use a constructor.
const pingbox = pingbox.init("YOUR_API_KEY", {
baseUrl: "http://YOUR_LOCAL_IP:3001",
logLevel: "debug"
});
baseUrl must point to your running backend server.
Generate a binding code and display it to the user.
const { bindingCode, expiresIn } = await pingbox.lockin();
console.log("Enter this code in the pingbox app:", bindingCode);
console.log("Expires in", expiresIn, "seconds");
The user enters this code inside the mobile app to complete the binding.
Once a device is bound, you can send notifications at any time.
await pingbox.shoot(
"Welcome",
"Thanks for joining our platform",
{
url: "https://yourwebsite.com",
queueIfOffline: true
}
);
Notifications are delivered as real native mobile notifications.
If the backend is temporarily unreachable, notifications are automatically queued and retried.
<!DOCTYPE html>
<html>
<body>
<button onclick="connect()">Bind Device</button>
<button onclick="notify()">Send Notification</button>
<script src="/path/to/pingbox.min.js"></script>
<script>
const pingbox = pingbox.init("YOUR_API_KEY", {
baseUrl: "http://YOUR_LOCAL_IP:3001"
});
async function connect() {
await pingbox.lockin();
alert("Enter the displayed code in the pingbox app");
}
async function notify() {
await pingbox.shoot("Hello", "Notification from the web");
}
</script>
</body>
</html>
FAQs
Native push notifications for websites without native apps
The npm package pingboxjs receives a total of 2 weekly downloads. As such, pingboxjs popularity was classified as not popular.
We found that pingboxjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.