Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sn-bold-editor
Advanced tools
The Bold Editor is a Standard Notes derived editor that offers text formatting and FileSafe integration.
The Bold Editor is a Standard Notes derived editor that offers text formatting and FileSafe integration.
Get a full working copy of the editor (with FileSafe) for development.
Clone the bold-editor and filesafe-embed repositories from GitHub.
Ensure that either the Standard Notes desktop app is available for use or the web app is accessible. Use both locally or with an Extended account (or the extension will not load).
In the bold-editor
folder, edit the package.json
file under devDependencies
to use the local filesafe-embed
:
"filesafe-embed": "~/folder_with_both_repositories/filesafe-embed",
Run npm i
in both the bold-editor
and filesafe-embed
folders to install the required dependencies.
package-lock.json
file and node_modules
folder. Then run npm i
again. (source)Edit app/index.html
for use locally:
<!-- Development -->
<script type="text/javascript" src="redactor.min.js"></script>
<script type="text/javascript" src="app.min.js"></script>
<!-- Production -->
<!--<script type="text/javascript" src="dist.min.js"></script>-->
Run npm run build
to build the files.
Run npm i -g http-server
to install a simple local server to host the extension.
Choose between webpack Watch Mode and webpack-dev-server for development and follow the corresponding instructions.
Start by following the instructions here: https://docs.standardnotes.org/extensions/local-setup. Included in the repository is an ext.json.sample
file that can be used in the setup.
This will setup a local server from which the bold-editor can be imported via the desktop app or the web app. You should be able to use the bold-editor now.
However, this will not allow for easy development because the app will not automatically build to the dist folder. We will use webpack for this.
Use npm run watch
to automatically build files.
http-server
npm run watch
Disable the cache on the desktop app/web app.
Ctrl+Shift+i
) and go to Network
Disable cache
Make some changes to Editor.js
, reload the desktop or web app, and your changes will show up.
Note that this method only actively builds app.min.js
.
The steps are similar to the webpack Watch Mode, differences are listed below:
ext.json
file belongs in the dist
folderhttp://localhost:8080
npm run start
to use the webpack-dev-server.Disable the cache as in the webpack Watch Mode. Reload may be required to see changes in action.
In production environments, check that the index.html
file is configured as follows:
<!-- Development -->
<!-- <script type="text/javascript" src="redactor.min.js"></script>
<script type="text/javascript" src="app.min.js"></script> -->
<!-- Production -->
<script type="text/javascript" src="dist.min.js"></script>
dist.min.js
is built via grunt
.
The CSS is also built with grunt, so webpack-dev-server will not be able to reload it. You must run npm run build
anytime you change the CSS.
Please open a new issue and the Standard Notes team will take a look as soon as we can. For more information on editors, refer to the following link:
Known issue: ordered lists, unordered lists, and tables seem to ignore any font preference you apply to it.
FAQs
The Bold Editor is a Standard Notes derived editor that offers text formatting and FileSafe integration.
We found that sn-bold-editor demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.