
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
animation
Advanced tools
First and foremost, this plugin gives you all the tools you need to write and apply css3 animations in compass. As a bonus, and only if you so choose, it also supplies you with a "shit-ton" (roughly 2 metric tons) of pre-fabricated animations taken from Dan Eden's "Animate.css" project.
This plugin requires the most recent alpha releases of Sass 3.2.0 (alpha.95) and Compass 0.12.0.
gem install animation --pre
require 'animation'
@import animation
The default import only includes the core mixins for creating animations. They are:
// create your animation
+keyframes($name)
@content
// apply animation(s) and adjust settings
+animation-name([$name-1, $name-2, ..., $name-10])
+animation-duration([$duration-1, $duration-2, ..., $duration-10])
+animation-delay([$delay-1, $delay-2, ..., $delay-10])
+animation-timing-function([$function-1, $function-2, ..., $function-10])
+animation-iteration-count([$count-1, $count-2, ..., $count-10])
+animation-direction([$direction-1, $direction-2, ..., $direction-10])
+animation-fill-mode([$mode-1, $mode-2, ..., $mode-10])
+animation-play-state([$state-1, $state-2, ..., $state-10])
// shortcut to apply and adjust
+animation([$animation-1, $animation-2, ..., animation-10])
There are default variables available for all of them:
$default-animation-name : false
$default-animation-duration : false
$default-animation-delay : false
$default-animation-timing-function : false
$default-animation-iteration-count : false
$default-animation-direction : false
$default-animation-fill-mode : false
$default-animation-play-state : false
Because the Animate code creates output, you need to import it (or one of it's sob-modules) directly:
@import animation/animate
That will create the following named animations:
flash bounce shake tada swing wobble pulsefadeIn fadeInUp fadeInDown fadeInLeft fadeInRight fadeInUpBig fadeInDownBig fadeInLeftBig fadeInRightBigfadeOut fadeOutUp fadeOutDown fadeOutLeft fadeOutRight fadeOutUpBig fadeOutDownBig fadeOutLeftBig fadeOutRightBigbounceIn bounceInDown bounceInUp bounceInLeft bounceInRightbounceOut bounceOutDown bounceOutUp bounceOutLeft bounceOutRightrotateIn rotateInDownLeft rotateInDownRight rotateInUpLeft rotateInUpRightrotateOut rotateOutDownLeft rotateOutDownRight rotateOutUpLeft rotateOutUpRightflip flipInX flipInY flipOutX flipOutYhinge rollIn rollOutYou can also import a set of predefined classes for each animation:
@import animation/animate/classes
FAQs
Unknown package
We found that animation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.