
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
vue-scroll-context
Advanced tools
Vue directive that passes some positioning context to a callback
Import the directive and register it in your component
import { directive } from 'vue-scroll-context';
export default {
name: 'Example',
directives: {
scrollContext: directive,
}
}
Add the now registered v-scroll-context directive (or whatever you have called it) to your element and pass it a callback (required). You can also provide params to be passed into the callback.
You can also pass in the throttle value which will be passed to lodash.trottle.
<figure v-scroll-context="{ callback: scrollCallback, params: { multiplier: 0.05 }, throttle: 30 }">
<img ... />
</figure>
The callback gets passed the element, the calculated context and the params you passed into the directive. The context consists of
rect which is the result of getBoundingClientRect()amountRevealed which is the numbers of pixels the element is in view (only if it's in view or user scrolled past, otherwise returns 0)
You can use it to create a parallax effect, for example:
export default {
name: 'Example',
methods: {
scrollCallback(el, ctx, params) {
el.style.transform = `translateY(-${ctx.amountRevealed * params.multiplier}px)`;
},
},
};
MIT
FAQs
Vue directive that passes some positioning context to a callback
The npm package vue-scroll-context receives a total of 1 weekly downloads. As such, vue-scroll-context popularity was classified as not popular.
We found that vue-scroll-context demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.