Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A nano-sized preconnect
hint wrapper.
ES5 (.js) version
ES6 (.mjs) version
preconnect is a very small script that allows you to programmatically invoke a preconnect
hint to any host to mask connection latency. The script is designed so that you can invoke this hint whenever is appropriate for your application.
Since preconnect is Just JavaScript™, you can install it with npm as a production dependency:
npm i preconnect --save
If you're not the npm type, grab one (or both) of the minified versions in this repo's dist
folder. There are two minified versions:
preconnect.min.js
is the Babel-fied ES5 build. It assigns a variable named preconnect
on the window
.preconnect.min.mjs
is the untransformed minified ES6 build. Its default
export
is a function eponymously named preconnect
.import preconnect from "preconnect";
const preconnecter = new preconnect({
// Injects `dns-prefetch` hints in addition to `preconnect` hints
getDns: true
});
// Preconnects to a link as the user hovers over it
document.getElementById("some-link").addEventListener("mouseover", event => {
preconnecter.add(event.target.href);
}, {
// Execute this event handler code only once avoid multiple injections of hints
once: true
});
In the above example, an early connection is established to the host specified in an <a>
element's href
value. This could potentially speed up navigation to that host for the user, improving the perceived performance of the navigation.
When you instantiate a new instance of preconnect, you can pass in an options object. There are two options:
getDns
(default: false
)dns-prefetch
hint in addition to a preconnect
hint. Some browsers don't support preconnect
, but some of those browsers do support dns-prefetch
. Enabling this ensures those browsers still receive some kind of benefit.timeout
(default: 0
)requestIdleCallback
to take advantage of idle browser time. This helps to reduce monopolization of the main thread so that the page is more responsive to user input. This option specifies, in milliseconds, the deadline by which requestIdleCallback
must inject the resource hint elements into the document <head>
. A value of 0
(the default) disables the use of requestIdleCallback
entirely.If you'd like to contribute, please file an issue first so we can discuss. Because I'd like to keep this script very small and simple, new features aren't likely to be added unless the weight they add can be justified.
My name is Jeremy Wagner. I'm an independent web performance consultant. I write about web stuff, and sometimes I even get to talk about web stuff. I also ramble on Twitter @malchata and make web performance videos on YouTube.
FAQs
A nano-sized `preconnect` hint wrapper.
We found that preconnect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.