Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
vue-script2
Advanced tools
VueScript2 brings back the <script>
tag to your SPA (Single Page App)!
This tiny library should take care of all your declarative and imperative asynchronous loading needs. Web designers can rest easy knowing their existing knowledge of web development is still useful!
This version is tailored for the Vue.js framework, but it's easy to port to Riot.js and others.
VueScript2 is primarily for internal use and not for standalone components that are being shared publicly. Those should be "self-contained" and come with all the JS they need.
<script>
except with a 2
, but even that can be fixed!app.js
bundle small!.ejs
templates or .html
files!unload
attribute can be used to keep your app's memory usage low!Oh, and it's easy to modify this library to also support imperative loading of
npm install vue-script2 --save
Then enable the plugin (in your main.js
or wherever):
Vue.use(require('vue-script2'))
Note: you can write <script>
instead of <script2>
using script2ify
! :smile:
Using vue-script2
with vue-router
is simple. Say that only one of your routes displays a "page" that makes use of jQuery. Well, no need to include all of jQuery in your app.js
bundle, now you can throw this in:
<script2 src="/path/to/jquery.min.js"></script2>
Boom!
And don't worry, script2
won't re-download scripts if they're already loaded.
Imperatively load scripts with VueScript2.load
:
VueScript2.load('/path/to/jquery.min.js').then(function () {
$('#msg').text('Hello from VueScript2!')
})
For 99% of use-cases this is totally sufficient and you do not need the overhead of RequireJS or SystemJS or whatever else. That's especially true given that Vue.js is normally used with Browserify or Webpack, which handle complicated dependency management for you.
NOTE: scripts injected using VueScript2.load
are always async
.
Want to run some JavaScript only when a specific "page"/route is visited and only after a library has finished loading? Simple!
<script2 src="/path/to/jquery.min.js"></script2>
<script2>
// Ordered execution should ensure that '$' is available here
$(document).ready(function () {
// this code runs *only* when the route
// that contains this code is loaded! :D->-<
})
</script2>
unload
attributeThe unload
attribute accepts JS expressions to run when the component is destroyed. This prevents your SPA from accumulating stuff in memory that's not being used:
<script2 src="/path/to/jquery.min.js" unload="jQuery.noConflict(true)"></script2>
async
attributeAlthough technically all scripts are inserted with s.async = false
(since we're using document.write
, see this wonderful article by Jake Archibald for details), setting the async
attribute does make a meaningful difference.
By default, the loading of <script2>
tags is serialized using promises so that one script loads after another has finished. If you don't care about the loading order, add async
to have the script injected into the page immediately.
You can mix and match so that some <script2>
tags are loaded immediately while others wait for the ones before them:
<script2 src="jquery.min.js"></script2>
<script2>$('#foo').text('hi!')</script2>
<!-- Load next script immediately, don't wait for jQuery -->
<script2 src="lib.js" async></script2>
<script>
instead of <script2>
using script2ify
The script2ify
browserify transform below will (fairly safely) dynamically replace <script>
tags with <script2>
tags within .ejs
, .html
, and even .vue
files!
var through = require('through2')
// This will replace <script> with <script2> in .html, .vue and .ejs files
// EXCEPT:
// - within <!-- comments -->
// - top-level <script> tags within .vue files
// Additional exclusion per: http://www.rexegg.com/regex-best-trick.html
// Excluding <pre> tags did not seem to work, however.
function script2ify (file) {
return !/\.(vue|html|ejs)$/.test(file) // edit to support other file types
? through()
: through(function (buf, encoding, cb) {
// avoid replacing top-level <script> tags in .vue files
var regex = /\.vue$/.test(file)
? /<!--.*?-->|^<script>|^<\/script>|(?:<(\/)?script([ >]))/gm
: /<!--.*?-->|(?:<(\/)?script([ >]))/gm
var replacement = (m, p1, p2) => p2 ? `<${p1 || ''}script2${p2}` : m
cb(null, buf.toString('utf8').replace(regex, replacement))
})
}
crossorigin
attribute (thx @grempe!)VueScript2.load
imperative loadingscript2ify
in the README1.1.0
, just adds needed package.json info.async
attribute.FAQs
Brings back <script> to your favorite Single Page App!
The npm package vue-script2 receives a total of 6,324 weekly downloads. As such, vue-script2 popularity was classified as popular.
We found that vue-script2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.