Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
ES5 (.js) version
ES6 (.mjs) version
yall.js is a featured-packed SEO-friendly lazy loader for <img>
, <picture>
, <video>
and <iframe>
elements, and can also lazy load CSS background images. It works in all modern browsers as well as IE11. It uses Intersection Observer where available, but as of version 3, this API must be polyfilled for older browsers. It can also monitor the DOM for changes using Mutation Observer to lazy load media elements that have been appended to the DOM after initial page render, which may be desirable for single page applications. It can also optimize use of browser idle time using requestIdleCallback
.
To use yall, you can grab yall.min.js
(or yall.min.mjs
if you're the modern sort) from the dist
directory and slap it on your page. You can also install version 3 with npm by pointing to the next
tag:
npm install yall-js@next
This is version 3 of yall.js, and introduces breaking changes over all prior versions. This is simplest way to initialize yall.js:
document.addEventListener("DOMContentLoaded", yall);
The above syntax is sufficient if you don't want to pass in any options. If you do want to specify options, you'll need to use a slightly more verbose syntax:
document.addEventListener("DOMContentLoaded", function() {
yall({
observeChanges: true
});
});
Unlike version 2 which provided a fallback for browsers without IntersectionObserver
support, version 3 requires a polyfill. You can conditionally polyfill this feature through polyfill.io like so:
<script src="https://polyfill.io/v2/polyfill.min.js?features=IntersectionObserver"></script>
From there, lazy loading elements depends on what you want to lazy load. Let's take a look at what you can do with it.
<img>
Let's look at a typical <img>
element use case:
<!-- An src-only <img> element example -->
<img class="lazy" src="placeholder.jpg" data-src="image-to-lazy-load.jpg" alt="Alternative text to describe image.">
Here, we specify an optional placeholder image in the src
attribute, and point to the image we want to lazy load in the data-src
attribute. Attaching a class
of lazy
exposes elements to yall.js, and is necessary for the lazy loader to work (although this class value can be overridden). Let's look at an example using both src
and srcset
:
<!-- A somewhat more complex src + srcset example -->
<img class="lazy" src="placeholder.jpg" data-srcset="image-to-lazy-load-2x.jpg 2x, image-to-lazy-load-1x.jpg 1x" data-src="image-to-lazy-load-1x.jpg" alt="Alternative text to describe image.">
Note: If you're using media
and sizes
attributes, you don't need to prefix them with data-
. Leave those attributes as is.
<picture>
Since <picture>
is a thing, yall.js supports that too:
<!-- A more complex <picture> + <img> + src/srcset example -->
<picture>
<source data-srcset="image-to-lazy-load-2x.webp 2x, image-to-lazy-load-1x.webp 1x" type="image/webp">
<img class="lazy" src="placeholder.jpg" data-srcset="image-to-lazy-load-2x.jpg 2x, image-to-lazy-load-1x.jpg 1x" data-src="image-to-lazy-load-1x.jpg" alt="Alternative text to describe image.">
</picture>
<video>
yall.js covers two possible lazy loading patterns for video.
You can use yall.js to lazy load <video>
elements intended to replace animated GIF with autoplaying video:
<video class="lazy" autoplay loop muted playsinline>
<source data-src="video.webm" type="video/webm">
<source data-src="video.mp4" type="video/mp4">
</video>
The pattern is largely the same as it is with <picture>
, only the lazy
class is applied to the <video>
element. Tip: If you're embedding videos that don't emulate animated GIFs (i.e., non autoplaying video), it's better to not lazy load them. Instead, lean on the preload
attribute to defer loading of video content. Please note that video autoplay policies may change at any time, meaning your video may not autoplay on some platforms! Such behaviors are not bugs, but rather features designed to conserve the user's bandwidth and preferences. Filing issues related to video autoplay will likely be rejected.
poster
placeholder images for non-autoplaying videoSometimes you have video you'd rather not autoplay, such as those videos with an audio track. Or, perhaps you want to be more considerate of your user's bandwidth (how nice of you). In these cases, the poster
attribute can be used to load a placeholder image. However, these images can also be rather large, especially if you have a number of videos on the page that use this pattern. As of version 2.2.0, you can now lazy load poster
images with the following markup pattern:
<video class="lazy" data-poster="placeholder.jpg" controls preload="none">
<source src="video.webm" type="video/webm">
<source src="video.mp4" type="video/mp4">
</video>
This pattern is slightly different than the one above. Because we're not trying to emulate animated GIFs, we've removed a number of attributes from the video
tag that aren't necessary in this case:
1., We've done away with the usual data-src
attribute, and specified preload="none"
to ensure the browser doesn't preload any of the video (which, depending on the browser, is not guaranteed).
2. To lazy load the poster
image itself, we specify the image to load in a data-poster
attribute.
3. The controls
attribute is added here to allow the user to control video playback.
Note: For the sake of your users, don't mix the above markup patterns. If a video is going to use autoplay
to replace an animated image, lazy loading a placeholder image via data-poster
isn't necessary. In fact, it's potentially wasteful. Furthermore, if you're unsure of what to do, let the browser handle this stuff and don't use yall.js to manage loading of videos.
<iframe>
As of version 2, you can also lazy load <iframe>
s:
<iframe class="lazy" data-src="some-other-document.html"></iframe>
Last, but not least, you can use yall.js to lazy load images referenced in CSS. This might be useful if you have a very large background-image
you'd like to defer. Proper use of this feature requires both HTML and CSS. To start, let's say you have a <div>
that loads a very large masthead background-image
:
<!-- I bet this loads a giant stock photo! -->
<div class="masthead lazy-bg"></div>
The key here is the lazy-bg
class, which is a class yall.js looks for (and can be changed via the lazyBackgroundClass
option). When yall.js sees elements with this class, it will remove that class and replace it with a class of lazy-bg-loaded
(which can also be changed with the lazyBackgroundLoaded
option). From here, it's up to you to author CSS that makes use of this class to swap the image in. Such CSS might look like this:
/* Pre-lazy loading styles */
.masthead {
background: #e6e6e6; /* A little placeholder color */
height: 16.66vw;
margin: 0 0 1rem;
}
/* BAM! Lazy loaded! */
.masthead.lazy-bg-loaded {
background: url("masthead.jpg");
}
This works because, unlike HTML which loads most resources immediately, CSS loads resources only if the current state of the document builds a CSSOM which includes them. That means if your document's style tree changes later on to request a background image, the browser will fetch it the moment the change is applied. Leaning on this behavior is more sensible than using a mess of data-
attributes pointing to possible image candidates, which could potentially add a bunch of extra markup and introduce edge cases that are difficult to code for.
Slap on some <noscript>
:
<!-- A <noscript> example using <img> with src and srcset. -->
<img class="lazy" data-srcset="/img/image-to-lazy-load-2x.jpg 2x, /img/image-to-lazy-load-1x.jpg 1x" data-src="/img/image-to-lazy-load-1x.jpg" src="/img/placeholder.jpg" alt="Alternative text to describe image.">
<noscript>
<img srcset="/img/image-to-lazy-load-2x.jpg 2x, /img/image-to-lazy-load-1x.jpg 1x" src="/img/image-to-lazy-load-1x.jpg" alt="Alternative text to describe image.">
</noscript>
<!-- And a <picture> example. -->
<picture>
<source data-srcset="/img/image-to-lazy-load-2x.webp 2x, /img/image-to-lazy-load-1x.webp 1x" type="image/webp">
<img class="lazy" data-srcset="/img/image-to-lazy-load-2x.jpg 2x, /img/image-to-lazy-load-1x.jpg 1x" data-src="/img/image-to-lazy-load-1x.jpg" src="/img/placeholder.jpg" alt="Alternative text to describe image.">
</picture>
<noscript>
<picture>
<source srcset="/img/image-to-lazy-load-2x.webp 2x, /img/image-to-lazy-load-1x.webp 1x" type="image/webp">
<img srcset="/img/image-to-lazy-load-2x.jpg 2x, /img/image-to-lazy-load-1x.jpg 1x" src="/img/image-to-lazy-load-1x.jpg" alt="Alternative text to describe image.">
</picture>
</noscript>
<!-- Here's a <video> example, too. -->
<video class="lazy" autoplay loop muted playsinline>
<source data-src="video.webm" type="video/webm">
<source data-src="video.mp4" type="video/mp4">
</video>
<noscript>
<video autoplay loop muted playsinline>
<source src="video.webm" type="video/webm">
<source src="video.mp4" type="video/mp4">
</video>
</noscript>
<!-- Here's an <iframe> example for good measure. -->
<iframe class="lazy" data-src="lazy.html"></iframe>
<noscript>
<iframe src="lazy.html"></iframe>
</noscript>
Then place a no-js
class on the <html>
element:
<html class="no-js">
Finally, add this one line <script>
before any <link>
or <style>
elements in the document <head>
:
<!-- Remove the no-js class on the <html> element if JavaScript is on -->
<script>document.documentElement.classList.remove("no-js")</script>
Normally, this script will remove the no-js
class from the <html>
element as the page loads, but if JavaScript is turned off, this will never happen. From there, you can add some CSS that hides elements with a class
of lazy
when the no-js
class is present on the <html>
element:
/* Hide .lazy elements if JavaScript is off */
.no-js .lazy {
display: none;
}
To see all use cases in action, check out the demos in the test
folder.
When you call the main yall
initializing function, you can pass an in an options object. Here are the current options available:
lazyClass
default: "lazy"
The element class used by yall.js to find elements to lazy load. Change this is if a class
attribute value of lazy
conflicts with your application.
lazyBackgroundClass
default: "lazy-bg"
The element class used by yall.js to find elements to lazy load CSS background images for. Change this if you'd prefer not to use the default.
lazyBackgroundLoaded
default: "lazy-bg-loaded"
When yall.js finds elements using the class specified by lazyBackgroundClass
, it will remove that class and put this one in its place. This will be the class you use in your CSS to bring in your background image when the affected element is in the viewport.
idleLoadTimeout
default: 100
In environments where requestIdleCallback
is available, this option sets a deadline in milliseconds for requestIdleCallback
to kick off lazy loading for an element. If this option is set to 0
, requestIdleCallback
is never called, and lazy loading for the affected element(s) will begin immediately once they're in the viewport.
threshold
default: 200
The threshold (in pixels) for how far elements need to be within the viewport to begin lazy loading.
observeChanges
default: false
Use a Mutation Observer to examine the DOM for changes. This is useful if you're using yall.js in a single page application and want to lazy load resources for markup injected into the page after initial page render. Note: This option is ignored if set to true
in a browser that doesn't support Mutation Observer!
observeRootSelector
default: "body"
If observeChanges
is set to true
, the value of this string is fed into document.querySelector
to limit the scope in which the Mutation Observer looks for DOM changes. The <body>
element is used by default, but you can confine the observer to any valid CSS selector (e.g., #main-wrapper
).
mutationObserverOptions
default: { childList: true, subtree: true }
Options to pass to the MutationObserver
instance. Read this MDN guide for a list of options.
It is not this script's job to minimize layout shifting for you. Use appropriate width
and height
attributes, as well as lightweight placeholders for your images.
In the case of <video>
, avoid lazy loading a placeholder with the data-poster
attribute for autoplaying videos and just use poster
. On the other hand, do consider lazy loading a placeholder image with data-poster
for non-autoplaying videos.
For general guidance, please check out the test
folder to see how you might use placeholders with yall.js. If you don't want to bother with placeholders, you can omit them. yall.js will still work, though the experience may be weird and jumpy and weird for your users as resources load.
Also, do not lazy load resources that are likely to near the top of the page ("above the fold", as it were). Doing so is a performance anti-pattern, because those resources will not begin loading until yall.js has been loaded, which may take much longer than if those resources were loaded normally.
If you have an idea, file an issue and let's talk about it. Unsolicited pull requests for new features will generally be rejected unless those requests contain bug fixes. Please see CONTRIBUTING.md
for more details. If your issue is related to version 3, please indicate as such in your issue.
Thank you to BrowserStack for graciously providing free cross-platform browser testing services!
FAQs
Yet Another Lazy Loader
We found that yall-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.