Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Skate is a library built on top of the W3C web component specs that enables you to write functional and performant web components with a very small footprint.
Skate is high level, functional abstraction over the web component specs that:
props
, such as attribute reflection and coercionHTML
<x-hello name="Bob"></x-hello>
JavaScript
import { Component, h, propString } from 'skatejs';
customElements.define('x-hello', class extends Component {
static props = {
name: propString
}
renderCallback ({ name }) {
return h('span', `Hello, ${name}!`);
}
});
Result
<x-hello name="Bob">
#shadow-root
<span>Hello, Bob!</span>
</x-hello>
Whenever you change the name
property - or attribute - the component will re-render, only changing the part of the DOM that requires updating.
There's a couple ways to consume Skate.
npm install skatejs
Skate exports a UMD build in umd/
so you can:
import * as skate from 'skatejs';
<script src="https://unpkg.com/skatejs/umd/skatejs.min.js"></script>
Since Skate exports a UMD definition, you can then access it via the global:
const { skate } = window;
Skate doesn't require you provide any external dependencies, but recommends you provide some web component polyfills depending on what browsers you require support for. Skate requires both Custom Elements and Shadow DOM v1.
To get up and running quickly with our recommended configuration, we've created a single package called skatejs-web-components
where all you have to do is load it before your definitions.
npm install skatejs @skatejs/web-components
And then load it up before everything else:
import 'skatejs-web-components';
import { Component } from 'skatejs';
Or you can use script tags:
<script src="https://unpkg.com/@skatejs/web-components/umd/@skatejs/web-components.min.js"></script>
<script src="https://unpkg.com/skatejs/umd/skatejs.min.js"></script>
If you want finer grained control about which polyfills you use, you'll have to BYO Custom Element and Shadow DOM polyfills.
If you’re using Babel or some other tool to transpile to ES5, simply import @skatejs/web-components
(or selectively include the polyfills) as needed and ignore the following.
Native custom element support requires that you load a shim if you're not delivering native ES2015 classes to the browser. If you're transpiling to ES5, you must - at the very least - load the native shim:
When you load Skate by module name (import { ... } from 'skatejs';
or require('skatejs');
), you'll be getting the transpiled source. Thus even if you author your components in ES2015, you'll still be getting ES5 base-classes and the native custom elements implementation will complain. If you want to deliever native classes you have to point to the non-transpiled Skate source: import { ... } from 'skatejs/src';
. Currently this is not supported by our API versioning but we have an issue to work around this.
More information can be found in the webcomponents/custom-elements repo.
Skate supports all evergreens and IE11. We recommend using the following polyfills:
Support us with a monthly donation and help us continue our activities. [Become a backer]
Become a sponsor and get your logo on our README on Github with a link to your site. [Become a sponsor]
FAQs
Skate is a library built on top of the W3C web component specs that enables you to write functional and performant web components with a very small footprint.
The npm package skatejs receives a total of 2,274 weekly downloads. As such, skatejs popularity was classified as popular.
We found that skatejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.