
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
vue-document-builder
Advanced tools
npm i vue-document-builder
yarn add vue-document-builder
<script>
import Vue from "vue";
import VueDocumentBuilder from "vue-document-builder";
import "vue-document-builder/dist/vue-document-builder.min.css";
export default Vue.extend({
name: "ServeDev",
data: () => ({
//Custom drag and drop components
blocks: [
{
idk "person-details",
label: "Personal Details",
media: "<i class='fa fa-list-ul fa-3x'> </i>",
content: `
<div data-property="full_name">
[Full Name Here]
</div>
<!-- Date example -->
<div data-property="date_of_birth" data-type="date">
[Date Of Birth Here]
</div>
<!-- Custom format example -->
<span data-property="age" data-type="custom" data-append=" years old"></span>
<!-- Default value example -->
<span data-property="status" data-default="N/A">[Status Here]</span>
<!-- Percentage format example -->
<div data-property="progress" data-type="percentage" data-precision="2">
[Progress]
</div>
<!-- Array of String Example -->
<div data-property="hobbies" data-seperator=",">
Hobbies: <span data-value></span>
</div>
<div>
<!-- Nested Property example -->
Address: <br/> <span data-property="address.street">[Street Here]</span>
...
</div>
<!-- Array of object example -->
<table data-property="employment_details" border="1" cellpadding="1">
<caption style="text-align: left; margin-bottom: 5px"><b>Cash Collaterals</b></caption>
<thead>
<tr>
<th data-key="employer" style="width: 20%;"> Employer</th>
<!-- Currency Example -->
<th data-key="salary" data-type="currency" data-number-seperator="," data-symbol="$" data-precision="2"> Salary</th>
</tr>
</thead>
</table>
`}
],
//Default options. See additional options at https://grapesjs.com/docs/api/editor.html#editor
options: {
//Width for the editor container
width: "auto",
//Height for the editor container
height: "100vh",
//Font Family to use on document
fontFamily: "'Roboto', sans-serif",
//Font size for paragraph tags
fontSize: "14px",
//Margin values for the page
margin: {
top: "1.5cm",
right: "1.5cm",
bottom: "1.5cm",
left: "1.5cm",
},
// Show paddings and margins
showOffsets: 1,
// If true, will fetch HTML and CSS from selected container
fromElement: true,
//Configurations for Storage Manager
storageManager: false,
//Additional Plugins
plugins: [],
//Configurations for Device Manager
deviceManager: {
default: "tablet",
devices: [
{
id: "tablet",
name: "Tablet",
width: "992px",
widthMedia: "992px",
},
],
},
},
}),
components: {
VueDocumentBuilder,
},
methods: {
async onSave(htmlcss) {
console.log(htmlcss);
},
},
});
</script>
<template>
<div id="app">
<vue-document-builder :options="options" :blocks="blocks" @save="onSave" />
</div>
</template>
<style>
body {
margin: 0px;
}
</style>
| Name | Description |
|---|---|
| save | returns html with inline css when the save button is clicked |
| Name | Default Value | Description |
|---|---|---|
| blocks | Array< Block > | A list of custom drag and drop components |
| options | Object{ fontFamily: String, fontSize: String, margin: { top: String, right: String, bottom: String, left: String, },...EditorConfiguration} | Document editor configurations. |
A Block is an object which allows you to add aditional drag and drop functionalities to the editor. See usage above for example.
//Structure
{
id: String, //Unique identifier eg. user-details
label: String, //Name of block
media: String, //Fontawesome Icon eg. <i class='fa fa-account fa-3x'> </i>
content: String // Html Content eg. <h2 data-propery="user.username>[Username]</h2>
}
In order to make the block content dynamic in the final html output add data-property to the html element in the content of the blocks with the object key from which the data will be populated. By doing this you can then use this library to populate the html output. See Usage for examples on how to make the blocks dynamic.
Formatters are denoted by the data-type attribute on an element and can have the value one of the following number, percentage, currency or date. If the data-type is not provided then the value remains as is. Formatters can also have specific options attached to them for instance, data-precision attribute which specify the number of decimal places to round a number to. See options below.
Number
Format a value to a number
| Options | Default Value | Description |
|---|---|---|
| data-precision | 0 | The number of decimal places to round the number to |
Number
Format a value to a percentage
| Options | Default Value | Description |
|---|---|---|
| data-precision | 0 | The number of decimal places to round the number to |
Currency
Formats a value to a specific currency
| Options | Default Value | Description |
|---|---|---|
| data-precision | 0 | The number of decimal places to round the number to |
| data-symbol | $ | The currency symbol to display |
| data-number-seperator | , | The digit separator |
Date
Tries to format value to the date format provided. If the date is already in the format, the data-type and data-format attribute can be left off.
| Options | Default Value | Description |
|---|---|---|
| data-format | - | See date format options below. Eg. data-format="yyyy-MM-dd" |
Format string can be anything, but the following letters will be replaced (and leading zeroes added if necessary):
Custom
Format value to a custom format by appending and/or prepending a custom string to it.
| Options | Default Value | Description |
|---|---|---|
| data-append | Comes after the value | |
| data-prepend | Comes before the value |
FAQs
### Installation
We found that vue-document-builder demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.