
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
window-pipe
Advanced tools
Browser window to window two-way communication based on `window.postMessage()`.
Browser window to window two-way communication based on window.postMessage().
Main features:
To start communication between two browser windows you need reference to each window object. On each end of communication pipe page has to reference window-pipe lib, and have to establish a connection. Pages can be loaded from different origins (different domains).
Below example shows communication between "Parent" page that embeds iframe with "Child" window. Web module imports have been used. In node enviroment replace them with import WindowPipe from 'window-pipe'
import WindowPipe from 'https://cdn.jsdelivr.net/npm/window-pipe@latest'
// *** PIPE SETUP
// create window pipe instance
const pipe = new WindowPipe
// get reference to iframe containg child window
// iframe element with src attribute and id 'child' set to child window page has to be already present in DOM.
const childFrame = document.getElementById('child')
pipe.authKey = 'window-pipe-demo'
// pipe internal loger
// pipe.onLog = (l) => console.log(l)
// await for iframe loading
childFrame.addEventListener('load', () => {
// set origin and window
pipe.targetOrigin = childFrame.src
pipe.targetWindow = childFrame.contentWindow
// start connecting the pipe
pipe.connect().then(() => console.log('CONNECTED!'))
});
// subscribe to received event
pipe.onReceived = cmd => console.log(cmd)
// send pipe command named 'ping-from-parent' every 2,5 seconds
setInterval(() => {
pipe.send({
method: 'ping-from-parent',
timeout: 0
})
}, 2500)
import WindowPipe from 'https://cdn.jsdelivr.net/npm/window-pipe@latest'
// *** PIPE SETUP
// create window pipe instance
const pipe = new WindowPipe
// set origin and window
// origin have to have exact match with parent page url
pipe.targetOrigin = 'https://cdpn.io/xtech-dev/fullpage/Exeqjxm?nocache=true&view=' // change to url / host of the window that embeds child window.
// because child window is embed into iframe we will be communicating with parent window
pipe.targetWindow = window.parent
// set key that will identify created pipe (distinguish between other parties that will send messages to same window)
pipe.authKey = 'window-pipe-demo'
// pipe internal loger
// pipe.onLog = (l) => console.log(l)
// connect to the pipe
pipe.connect().then(() => {
console.log('CONNECTED!')
})
// subscribe to received event
pipe.onReceived = cmd => console.log(cmd)
// send pipe command named 'ping-from-parent' every 3 seconds
setInterval(() => {
pipe.send({
method: 'ping-from-child',
timeout: 0
})
}, 3000)
https://codepen.io/xtech-dev/full/Exeqjxm
FAQs
Browser window to window two-way communication based on `window.postMessage()`.
We found that window-pipe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.