
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Sync time across all clients' web browsers and your server with high precision.
Syncs time between all clients and your server with high precision.
I have started to develop this package, as timesync does not offer the precision I need (because it's syncing via http) and ntp-time doesn't work in the browser (as it syncs via UDP). Hopefully syncing via WebSockets will offer enough performance...
Note: this package is still under development. Syncing is fully implemented but not tweaked for performance yet.
Install this package into your NodeJS project with
$ npm install tacitact
tacitact comes in three different flavors. You can import it into an ESM environment or request it in an CommonJS (CJS) environment which contain the Server as well as the Client class. It also comes as a bundled version for use in web which contains only the Client class.
If you want to use it with Vite (e.g. in an Vue3 app), you can install it via npm like shown before. Then you have set the web version as an alias and also tell Vite that it is pre-bundled. To do so, add the following lines to your vite.config.js file:
resolve: {
alias: {
fileURLToPath(new URL('./node_modules/tacitact/dist/web/tacitact.js', import.meta.url)
)
}
},
optimizeDeps: {
include: ['tacitact']
}
You might need to import fileURLToPath and URL first:
import { fileURLToPath, URL } from 'node:url'
You can then import it either as default:
import * as tacitact from 'tacitact'
Or as named import:
import { Client, Server } from 'tacitact'
Please have a look into the tests in this repo and the tacitact-examples repo to understand how tacitact can be used in those environments.
The examples repo shows how you can use this library. The examples can also serve as consumers for the library while you are developing.
Don't forget to install the dependencdies after you have cloned the repo by running
$ npm install
You can run tests with
$ npm run test
There are not many yet though.
Please note that the tests will run on the compiled production bundle, so the build will run before the tests are being executed.
To simplify development, you can build with
$ npm run dev
This will automatically re-build for all targets in development mode whenever it detects changes in the source code.
Note: if you have changed the webpack config
webpack.config.jsyou have to restart the above command as the config will not be hot-reloaded by webpack.
To have your changes directly synced with a consuming project, you can install the tacitact package into this project from the file system. Add the following dependency to your consumer's package.json file, where <path to tacitact directory> is the (relative) path to the directory where this very README.md (and more importantly tacitact's package.json) is located:
{
"dependencies": {
"tacitact": "file:<path to tacitact directory>"
}
}
To build for production, just run
$ npm run build
This will compile the client files in production mode. The build results will be placed in the dist directory.
FAQs
Sync time across all clients' web browsers and your server with high precision.
We found that tacitact demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.