Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
vue-script2
Advanced tools
Fully restores the <script>
tag to front-end single-page-app (SPA) frameworks! This version is for Vue.js, but it's easy to port to Riot.js and others.
It's meant for internal use, not for standalone components that are being shared publicly. Those should be "self-contained" and come with all the JS they need.
<script>
except with a 2
!1app.js
bundle small!.ejs
templates or .html
files!unload
attribute can be used to keep your app's memory usage low!npm install vue-script2 --save
Then enable the plugin (in your main.js
or wherever):
Vue.use(require('vue-script2'))
Simple, Traditional, Asynchronous Loading of Scripts
Using vue-script2
with vue-router
is simple. Say that only one of your routes displays a "page" that makes use of jQuery. Well, no need to include all of jQuery in your app.js
bundle, now you can throw this in:
<script2 src="/path/to/jquery.min.js"></script2>
Boom!
And don't worry, script2
won't re-download scripts if they're already loaded.
Delayed Execution of Inlined JavaScript
Want to run some JavaScript only when a certain "page"/route is loaded?
<script2 src="/path/to/jquery.min.js"></script2>
<script2>
// Ordered execution should ensure that '$' is available here
$(document).ready(function () {
// this code runs *only* when the route
// that contains this code is loaded! :D->-<
})
</script2>
Cleaning Up Resources On Route Change
The unload
attribute accepts JS expressions to run when the component is destroyed. This prevents your SPA from accumulating stuff in memory that's not being used:
<script2 src="/path/to/jquery.min.js" unload="jQuery.noConflict(true)"></script2>
Special support for async
attribute
Although technically all scripts are inserted with s.async = false
(since we're using document.write
, see this wonderful article by Jake Archibald for details), setting the async
attribute does make a meaningful difference.
By default, the loading of <script2>
tags is serialized using promises so that one script load serially. If you don't care about the loading order, add async
to have the script injected into the page immediately.
You can mix and match so that some <script2>
tags are loaded immediately while others wait for the ones before them:
<script2 src="jquery.min.js"></script2>
<script2>$('#foo').text('hi!')</script2>
<!-- Load next script immediately, don't wait for jQuery -->
<script2 src="lib.js" async></script2>
1.1.0
, just adds needed package.json info.async
attribute.1 If you don't like the 2
at the end, feel free to petition your favorite SPA framework to add native support.
FAQs
Brings back <script> to your favorite Single Page App!
The npm package vue-script2 receives a total of 6,324 weekly downloads. As such, vue-script2 popularity was classified as popular.
We found that vue-script2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.