
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Xembly engine for JavaScript.
Make sure you understand what is Xembly and what does directives mean before using this library.
As npm module:
npm install --save xembly
import it from your module:
import {Xembler, Directives} from 'xembler';
new Xembler(new Directives().add('span').set('hello'))
.apply(document, document.getElementById('content'));
Also you can build bundle file to use it in browser:
git clone --depth=1 https://github.com/g4s8/xembly-js.gitcd xembly-jsnpm installnpm run bundle (or env PROD_ENV npm run bundle to
build optimized for size bundle)../lib/xembly.js bundle to your assetsxembly variable, e.g. new xembly.Xembler()You can check ./examples directory for working example.
Xembler class can apply directives
to DOM using
raw string directives: new Xembler('ADD span;SET hello'),
or helper objects: new Xembler(new Directives().add('span').set('hello'))
and apply to to DOM elements:
var div = document.getElementById('content');
// add span with 'hello' text to `div`
new Xembler(new Directives().add('span').set('hello'))
.apply(document, div);
More complex example creates new HTML form with input fields:
var div = document.getElementById('content');
new Xembler(
new Directives()
.xpath('form[@id = "login-form"]') // move cursor to login form
.push().xpath('input').remove().pop() // remove existing inputs
.add('label').attr('for', 'login').set('Username').up() // add label for username
.add('input').attr('type', 'text').attr('name', 'username').up() // add username input
.add('label').attr('for', 'password').set('Password')
.add('input').attr('type', 'password').attr('name', 'password').up()
.add('input').attr('type', 'submit').attr('value', 'Sign in').up()
).apply(document)
FAQs
Xembler engine for JavaScript
We found that xembly demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.