
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
posecode-embed
Advanced tools
Embed a live 3D Posecode movement anywhere with one <script> tag — the web component.
Embed a live 3D Posecode movement anywhere with one <script> tag.
posecode-embed ships a framework-free <posecode-player> web component. Drop
it into a blog post, docs page, physio program, or an LLM chat UI, and it renders
the movement as an animated 3D figure, right where a share link would have gone.
<script src="https://unpkg.com/posecode-embed@latest/dist/posecode-embed.js"></script>
<!-- 1. From a share token (what a posecode.org permalink carries) -->
<posecode-player doc="cG9zZWNvZGUgZXhlcmNpc2Ug…"></posecode-player>
<!-- 2. From a URL to a .posecode file -->
<posecode-player src="/movements/squat.posecode"></posecode-player>
<!-- 3. From inline text: reads like the language itself -->
<posecode-player>
posecode exercise "Lateral raise"
rig humanoid
pose start = standing
step "Raise" 1.4s settle:
shoulders: abduct 90
elbows: flex 10
step "Lower" 1.6s drive:
shoulders: abduct 0
elbows: flex 0
repeat 8
</posecode-player>
The script auto-registers the element and boots each player when it scrolls into view. That's it.
Replace @latest with an exact package version in production so a deployment
always uses a known parser/render pair. A src URL can be relative or absolute;
cross-origin movement files must be served with CORS permission.
npm install posecode-embed
import "posecode-embed"; // auto-registers <posecode-player>
Or register it yourself for controlled timing:
import { definePosecodePlayer } from "posecode-embed";
definePosecodePlayer(); // idempotent
| Attribute | Default | Description |
|---|---|---|
doc | n/a | A posecode-share token (highest precedence). |
src | n/a | URL of a .posecode file to fetch. |
| (inline text) | n/a | The element's text content, used if doc/src are absent. |
autoplay | true | Play as soon as the movement loads. |
loop | true | Loop the timeline. |
controls | true | Show the play/pause bar. |
autorotate | true | Slowly orbit the camera when idle. |
speed | 1 | Playback multiplier (0.1–4). |
character | (hosted default) | Realistic figure: a GLB URL (Mixamo rig), or off for the procedural mannequin. Load failures fall back to the mannequin. |
playground | https://posecode.org/play | Base URL for the "Edit ↗" link. |
Boolean attributes accept false / 0 / no / off to turn them off, so
autoplay="false" works as expected.
prefers-reduced-motion (no autoplay, no camera
orbit) and exposes a labelled play/pause control.posecode:error event.const player = document.querySelector("posecode-player");
player.addEventListener("posecode:ready", (e) => {
console.log(e.detail.version, e.detail.languageVersion, e.detail.warnings);
player.viewer.pause();
});
player.addEventListener("posecode:error", (e) => {
console.warn(e.detail.code, e.detail.error, e.detail.errors);
});
player.toggle(); // play / pause
player.viewer; // the underlying render Viewer (null until booted)
The host element reflects data-posecode-state="loading|ready|error", plus the
package and language versions, for integration tests and monitoring. Existing
listeners that only read event.detail.error remain compatible.
CDN users can validate source without creating WebGL:
const result = Posecode.validatePosecode(source);
console.log(Posecode.version, Posecode.languageVersion, result.errors);
For a movement library in CI, run:
npx posecode-parser@latest validate --strict ./movements
AGPL-3.0-only, part of Posecode. A separate commercial license is available for closed-source product use.
FAQs
Embed a live 3D Posecode movement anywhere with one <script> tag — the web component.
We found that posecode-embed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.