
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
selectlist-polyfill
Advanced tools
<selectlist> polyfillBased on the proposal open-ui.org/components/selectmenu by Open UI.
This polyfill depends on the
Popover API
and comes with a light popover polyfill built-in.
So it doesn't require the
Popover polyfill
but aims to be compatible if you wish to use these together.
One of the goals was to research and create it as closely to spec as possible and use the learnings for the implementation in Media Chrome.
Until the native <selectlist> lands in one of the browsers it's recommended
to use the custom elements <x-selectlist> and <x-option> directly and not
use them as a polyfill.
This is to prevent breaking anything in the future
if the native <selectlist> API would change and you would be running a native
selectlist and a polyfilled selectlist with misaligned API's.
<script type="module" src="https://cdn.jsdelivr.net/npm/selectlist-polyfill/src/selectlist.min.js"></script>
<script type="module" src="https://cdn.jsdelivr.net/npm/selectlist-polyfill/src/option.min.js"></script>
<x-selectlist>
<x-option>Option 1</x-option>
<x-option>Option 2</x-option>
<x-option>Option 3</x-option>
</x-selectlist>
selectlist so the polyfill replaces selectlist elements
with x-selectlist elements via a mutation observer. If you prefer your elements
are not replaced use x-selectlist directly.<option> content not nested in <select> so option
elements nested under x-selectlist are automatically replaced with x-option
elements. Again if you prefer to keep the element instance intact use x-option
elements directly.<option> has a :checked pseudo selector state. This is not possible to polyfill,
so instead <x-option> adds the .\:checked CSS class to any selected option.FAQs
Polyfill for the selectlist element
We found that selectlist-polyfill demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.