
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
sveltefire
Advanced tools
A minimal, yet powerful library that puts realtime Firebase data into Svelte stores.
SvelteFire allows you to access Firebase Auth, Firestore, Storage, RealtimeDB, and Analytics with minimal complexity. It simplfies relational data with a declarative syntax, handles loading states, automatically disposes of realtime data subscriptions, and more!
Gaze in awe at the example below where we fetch multiple levels of realtime user data with just a few lines of Svelte code:
<!-- 1. 🔥 Firebase App -->
<FirebaseApp {auth} {firestore}>
<!-- 2. 👤 Get the current user -->
<SignedIn let:user>
<p>Howdy, {user.uid}</p>
<!-- 3 (a). 📜 Get a Firestore document owned by a user -->
<Doc ref={`posts/${user.uid}`} let:data={post} let:ref={postRef}>
<h2>{post.title}</h2>
<!-- 4 (a). 💬 Get all the comments in its subcollection -->
<Collection ref={postRef.path + '/comments'} let:data={comments}>
{#each comments as comment}
{/each}
...
Each component in this example above is underpinned by a Svelte store. These custom stores can be used for fine-grained control and to implement your own custom patterns.
Use stores to access Firebase data with Svelte's reactive $
syntax:
<script>
import { docStore } from 'sveltefire';
import { firestore } from '$lib/firebase'; // your firestore instance
const post = docStore(firestore, 'posts/id');
</script>
{$post?.title}
FAQs
SvelteFire <a href="https://discord.gg/f
The npm package sveltefire receives a total of 1,552 weekly downloads. As such, sveltefire popularity was classified as popular.
We found that sveltefire demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.