Snow JS ❄️

~ Securing Nested Ownership of Windows ~

/ Keeping an 👀 on these </code>s for ya! / </i><br /> <br/><br/><br /></div></p><p class="my-3">> _Snow is the <strong>most advanced</strong> open sourced tool for securing same origin realms in runtime browser apps - <strong>secured</strong> and <strong>easy to use</strong>:_</p><p class="my-3">* Include Snow in your web app's loading html file (or by <a href="#Install" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">requiring it as a module</a>):<br />``<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">html<br /><script src="https://unpkg.com/@lavamoat/snow/snow.prod.js"></script><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />* Pass Snow a callback and Snow will invoke it with <strong>every</strong> new window object in runtime!<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />SNOW( win => console.log('New window detected:', win) )<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><div align="center"><br /><img width="750" alt="❄️SNOW❄️" src="https://user-images.githubusercontent.com/13243797/219565727-12f00654-a709-4a39-87fc-5a60f643b308.png"><br /><br><br><br /><i> Snow aspires to standardize how to recursively and <b> securely own newborn windows </b> (aka iframes/realms) <br> within a browser web app, <br /><b> from the context of the app itself </b>. </i><br /></div></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">About</h2></p><p class="my-3">Snow is an experimental ⚠️ tool coming in the form of a <strong>JavaScript shim</strong> that once is applied to the page exposes an API that when is <br />provided with a callback, will make sure to call it with <strong>every new window</strong> that is being <br />injected to DOM, <strong>before</strong> its creator gets a hold on it.</p><p class="my-3">This ability exists for extensions (with the </code>all_frames: true<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> property), but </code>Snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> brings it<br />to <strong>non extension javascript with the same privileges as the web app</strong>.<br /> <br />> _Read more about Snow and the motivation behind it <a href="https://github.com/lavamoat/snow/wiki/Introducing-Snow" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">here</a>_</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">🚨 IMPORTANT UPDATE 🚨</h2></p><p class="my-3">Starting Version <a href="https://github.com/LavaMoat/snow/pull/134" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">2.0.1</a> Snow officially doesn't support vulnerabilities that<br />can be protected against by disallowing </code>unsafe-inline<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> completely and by correctly using the </code>object-src<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> directive to not allow </code>self<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">.<br />* To learn more why is that, see <a href="#install" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">section 4</a>.</p><p class="my-3">In addition, Snow <a href="https://github.com/LavaMoat/snow/pull/133" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">"stops playing nice"</a> - operations that are considered insecure will be intercepted and cause Snow to throw an exception.<br />This is part of the realization we reached as part of the work on Snow, where "nice security" leaves Snow vulnerable, and true security can only be shipped with a more "aggresive" approach.<br />* To learn more why is that, see <a href="https://github.com/LavaMoat/snow/pull/133" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#133</a>.</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3"><a href="https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Demo</a> - The Snow Challenge! 🏆</h2></p><p class="my-3"><div align="center"><br /><img width="759" alt="Screenshot 2023-02-25 at 19 54 33" src="https://user-images.githubusercontent.com/13243797/221372185-eaeea815-b693-43bf-a371-6375ce8e0e8b.png"><br /></div><br /><br></p><p class="my-3">Snow's challenge is the easiest way to <strong>graspe the power of Snow.</strong> </p><p class="my-3">Here we have a serverless <a href="https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">demo app</a>, which installs and <strong>uses Snow to disable the functionality of the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function</strong> for all same origin realms.<br /> <br />In other words, the app uses Snow to make sure <strong>no one can call the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function</strong>, not even when:<br />* Trying to create an </code><iframe><code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> and use its inner window's </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">;<br />* Trying to call the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function from the console (even self-XSS won't help you!);<br />* Trying to open a new tab and use its </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">.<br /> <br />Hence, the rulls are very simple - <strong>visit the <a href="https://lavamoat.github.io/snow/demo/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">app</a> and pop an alert! 😉</strong><br /> <br />If you manage to bypass Snow and pop an alert message - <strong>help us</strong> by opening an issue so we could continue to <strong>improve Snow's security</strong>!<br /> <br /><h2 class="text-xl font-semibold mt-5 mb-3">Usage</h2></p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />// API<br />SNOW(cb = (win) => { /<em> LOGIC </em>/ });</p><p class="my-3"><br />// example, disable alert API in the webpage completely<br />SNOW((win) => {<br /> win.alert = (msg) => {<br /> console.log('alert is disabled! msg is: ' + msg);<br /> };<br />});<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Install</h2></p><p class="my-3">The latest </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> <a href="https://raw.githubusercontent.com/lavamoat/snow/main/snow.prod.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">production version</a> is included in the official repo<br />and also in <a href="https://unpkg.com/@lavamoat/snow/snow.prod.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">upkg cdn</a>, so in order to<br />install </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> in the website, simply place it wherever and serve it to the website as-is:</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">html<br /><script src="https://unpkg.com/@lavamoat/snow/snow.prod.js"></script><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3">After this line, window should expose </code>window.SNOW<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> API for the<br />rest of the scripts in the website to use.</p><p class="my-3">Not like standard third party libraries, </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> has special requirements (security-wise) in order for it to play its role securely.</p><p class="my-3">> <strong>👇 It is highly important to be aware of them when integrating Snow into an app to gain full security - READ CAREFULLY 👇:</strong></p><p class="my-3">1. <strong>It has to run as the first piece of javascript that runs in the webpage</strong> - otherwise any<br /> other javascript code will have the ability to bypass </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> and cancel <br /> its purpose completely (that's why </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> can never overpower extensions).<br /> In order to achieve that, when loading via a script tag it must load script synchronously (do not use </code>async=true<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">!).</p><p class="my-3">2. <strong>It has to be served as-is</strong> - If it goes through any bundlers that might change it,<br /> the modified version might contain flaws that attackers might use to cancel its effect (for further<br /> explanation see <a href="https://github.com/lavamoat/snow/wiki/Introducing-Snow#natives" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">natives</a> section).</p><p class="my-3">3. <strong>Snow needs to be set and called in every HTML page served from your web app</strong> - Even though this is the attack vector<br /> Snow tries to protect the app against, there are types of attacks Snow won't be able to defend against (which is why<br /> we want Snow to become a native browser feature so bad!). This mainly refers to the <a href="https://github.com/LavaMoat/snow/issues/73" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#73 discovery</a>.<br /> The only way to defend the app against such an attack it to make sure all HTML files served by the app load Snow themselves.<br /> Does this make Snow useless? No - there are planty other types of attacks Snow defends your app against.</p><p class="my-3">4. <strong>Most importantly, it's highly vulnerable without minimal help from CSP</strong> - As of version 2.0.1 the project will<br /> seize to attempt to defend against vulnerabilities that aren't possible to exploit when <br /> (a) </code>unsafe-inline<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> isn't allowed and (b) </code>object-src<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> to </code>self<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> isn't allowed.<br /> This is because (a) defending against string-JS attacks is basically an endless task and probably impossible, and<br /> (b) </code>object<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">/</code>embed<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> elements behaviour is also too unpredictable while these elements shouldn't be even used in the<br /> first place. Snow will do its best regardless of what CSP is applied - <strong>use at your own risk!</strong> <br /> * please learn more about this ☝️ at <a href="https://github.com/LavaMoat/snow/pull/118/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#118</a> & <a href="https://github.com/LavaMoat/snow/pull/133/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#133</a></p><p class="my-3"><br /></code>SNOW<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> API can also be required as part of a bundle instead of a script tag:</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />yarn add @lavamoat/snow<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />const snow = require('@lavamoat/snow');<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Contribute</h2></p><p class="my-3">This project is an important POC aspiring to standardize how windows should be hermetically<br />handled, however it is not yet production ready.</p><p class="my-3"></code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> eventually is a shim that comes to both demonstrate and utilize the API we wish to see builtin to browsers in the future. <br />Until </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> becomes a platform builtin API, we have to attempt to overcome several challenges that are significantly harder to do so in pure javascript:</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3"></code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> supports Chrome, Firefox, Safari and all other Chromium based browsers (Opera, Edge, Brave, etc).</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Achieving a hermetic solution costs in performance. Injecting this script into some major<br />websites went smoothly while with some others it caused them some performance issues.</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Although this project takes the hermetic concept very seriously and massively tests for<br />potential flaws, </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> might potentially still have flaws which might enable attackers<br />to bypass its hooks.</p><p class="my-3">Bottom line - </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> might have security vulnerabilities!</p><p class="my-3">Hopefully in the future </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> will become a builtin API provided by the browser. <br />Achieving that goal will allow security assurance - such functionality will be safer to implement <br />on behalf of the browser rather than the web app.</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">In order to assure security, there are many tests that verify that </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />is fully hermetic as promised - everything that </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> supports is fully tested.</p><p class="my-3">The tests mainly try to bypass </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> in any possible way.</p><p class="my-3">If you found a vulnerability in </code>snow`, open a PR with a test that demonstrates it (or just let us know, and we'll do it).</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Help with promoting any of the topics above is very much appreciated in order for this project<br />to become production ready and reshape how hermetic window hooking should look like!</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Troubleshooting</h2></p><p class="my-3">In <a href="https://github.com/LavaMoat/snow/blob/main/src/log.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">log.js</a> file you can find references<br />to issues you might encounter using snow. <br />If you do, you should see an error/warning thrown to console in your application with a reference<br />to the relevant issue thread.</p><p class="my-3">In each thread a discussion around the issue is being made in order to better solve it, so please<br />share your experience with the issue in order for us to solve it in the best way possible.</p><p class="my-3">If you encounter an issue that is not being handled by snow correctly, please open a new one.</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Supporters</h2></p><p class="my-3">Funded by <a href="https://github.com/consensys" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Consensys 💙</a></p><p class="my-3">Maintained and developed by <a href="https://github.com/MetaMask" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">MetaMask 🦊</a><br /> <br />Part of the <a href="https://github.com/LavaMoat" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">LavaMoat 🌋</a> Javascript security toolbox</p><p class="my-3">Invented and developed by <a href="https://weizmangal.com/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Gal Weizman 👋🏻</a><br /></p></div><div class="flex justify-center absolute inset-x-0 bottom-0 bg-gradient-to-t from-background via-background to-transparent pb-4 pt-16"><button data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down mr-1 h-4 w-4"><path d="m6 9 6 6 6-6"></path></svg>Show more</button></div></div></div><template id="P:3"></template><template id="P:4"></template></div></div><div class="space-y-8"><div class="flex flex-col gap-6 lg:flex-row lg:gap-8"><div class="flex-1 space-y-4"><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-10 w-64"></div><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-6 w-full max-w-xl"></div><div class="flex gap-2"><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-6 w-16"></div><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-6 w-20"></div><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-6 w-14"></div></div></div><div class="w-full lg:w-80"><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-32 w-full"></div></div></div><div class="space-y-4"><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-10 w-64"></div><div data-slot="skeleton" class="bg-accent animate-pulse rounded-md h-64 w-full"></div></div></div></main></div><script>requestAnimationFrame(function(){$RT=performance.now()});</script><script src="/_next/static/chunks/9b9784636e791b20.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[39756,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"default\"]\n3:I[37457,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"default\"]\n4:I[49786,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"Header\"]\n5:I[22016,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"\"]\nc:I[68027,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"default\"]\nd:I[2355,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"Analytics\"]\nf:I[97367,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"OutletBoundary\"]\n10:\"$Sreact.suspense\"\n12:I[97367,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"ViewportBoundary\"]\n14:I[97367,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"MetadataBoundary\"]\n:HL[\"/_next/static/chunks/60ba853f5ed1b16b.css?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"style\"]\n:HL[\"/_next/static/chunks/9c76f6dd8b5c38e2.css?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"style\"]\n:HL[\"/_next/static/media/68d403cf9f2c68c5-s.p.f9f15f61.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/797e433ab948586e-s.p.dbea232f.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n:HL[\"/_next/static/media/caa3a2e1cccd8315-s.p.853070df.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"x_DymHuNhDTJUp7Mmr_Ru\",\"c\":[\"\",\"package\",\"%40lavamoat%2Fsnow\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"package\",{\"children\":[[\"name\",\"%40lavamoat/snow\",\"c\"],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/60ba853f5ed1b16b.css?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/9c76f6dd8b5c38e2.css?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[\"$\",\"body\",null,{\"className\":\"font-sans antialiased\",\"children\":[[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[\"$\",\"div\",null,{\"className\":\"min-h-screen bg-background\",\"children\":[[\"$\",\"$L4\",null,{}],[\"$\",\"main\",null,{\"className\":\"mx-auto flex max-w-md flex-col items-center justify-center px-4 py-24 text-center\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-package mb-6 h-16 w-16 text-muted-foreground\",\"children\":[[\"$\",\"path\",\"1a0edw\",{\"d\":\"M11 21.73a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73z\"}],[\"$\",\"path\",\"d0xqtd\",{\"d\":\"M12 22V12\"}],[\"$\",\"path\",\"yx3hmr\",{\"d\":\"m3.3 7 7.703 4.734a2 2 0 0 0 1.994 0L20.7 7\"}],[\"$\",\"path\",\"1c824w\",{\"d\":\"m7.5 4.27 9 5.15\"}],\"$undefined\"]}],[\"$\",\"h1\",null,{\"className\":\"mb-2 text-3xl font-bold\",\"children\":\"404\"}],[\"$\",\"h2\",null,{\"className\":\"mb-4 text-xl text-muted-foreground\",\"children\":\"Page not found\"}],[\"$\",\"p\",null,{\"className\":\"mb-8 text-muted-foreground\",\"children\":\"The page you're looking for doesn't exist or has been moved.\"}],[\"$\",\"div\",null,{\"className\":\"flex gap-3\",\"children\":[[\"$\",\"$L5\",null,{\"href\":\"/\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-house mr-1.5 h-4 w-4\",\"children\":[[\"$\",\"path\",\"5wwlr5\",{\"d\":\"M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8\"}],[\"$\",\"path\",\"1d0kgt\",{\"d\":\"M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"}],\"$undefined\"]}],\"Go home\"],\"data-slot\":\"button\",\"className\":\"inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg:not([class*='size-'])]:size-4 shrink-0 [\u0026_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive bg-primary text-primary-foreground hover:bg-primary/90 h-9 px-4 py-2 has-[\u003esvg]:px-3\",\"ref\":null}],[\"$\",\"$L5\",null,{\"href\":\"/search\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-search mr-1.5 h-4 w-4\",\"children\":[[\"$\",\"circle\",\"4ej97u\",{\"cx\":\"11\",\"cy\":\"11\",\"r\":\"8\"}],[\"$\",\"path\",\"1qie3q\",{\"d\":\"m21 21-4.3-4.3\"}],\"$undefined\"]}],\"Search packages\"],\"data-slot\":\"button\",\"className\":\"inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg:not([class*='size-'])]:size-4 shrink-0 [\u0026_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-9 px-4 py-2 has-[\u003esvg]:px-3\",\"ref\":null}]]}]]}]]}],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}],\"$L6\"]}]}]]}],{\"children\":[\"$L7\",{\"children\":[\"$L8\",{\"children\":[\"$L9\",{},null,false,false]},[\"$La\",[],[]],false,false]},null,false,false]},null,false,false],\"$Lb\",false]],\"m\":\"$undefined\",\"G\":[\"$c\",[]],\"S\":false}\n"])</script><script>self.__next_f.push([1,"6:[\"$\",\"$Ld\",null,{}]\n7:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n8:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n9:[\"$\",\"$1\",\"c\",{\"children\":[\"$Le\",[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$Lf\",null,{\"children\":[\"$\",\"$10\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@11\"}]}]]}]\na:null\nb:[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L12\",null,{\"children\":\"$L13\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L14\",null,{\"children\":[\"$\",\"$10\",null,{\"name\":\"Next.Metadata\",\"children\":\"$L15\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}]\n"])</script><script>self.__next_f.push([1,"e:[\"$\",\"div\",null,{\"className\":\"min-h-screen bg-background\",\"children\":[[\"$\",\"$L4\",null,{}],[\"$\",\"main\",null,{\"className\":\"mx-auto max-w-6xl px-4 py-8\",\"children\":[\"$\",\"$10\",null,{\"fallback\":[\"$\",\"div\",null,{\"className\":\"space-y-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex flex-col gap-6 lg:flex-row lg:gap-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex-1 space-y-4\",\"children\":[[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-10 w-64\"}],[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-6 w-full max-w-xl\"}],[\"$\",\"div\",null,{\"className\":\"flex gap-2\",\"children\":[[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-6 w-16\"}],[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-6 w-20\"}],[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-6 w-14\"}]]}]]}],[\"$\",\"div\",null,{\"className\":\"w-full lg:w-80\",\"children\":[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-32 w-full\"}]}]]}],[\"$\",\"div\",null,{\"className\":\"space-y-4\",\"children\":[[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-10 w-64\"}],[\"$\",\"div\",null,{\"data-slot\":\"skeleton\",\"className\":\"bg-accent animate-pulse rounded-md h-64 w-full\"}]]}]]}],\"children\":\"$L16\"}]}]]}]\n"])</script><script>self.__next_f.push([1,"13:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"17:I[27201,[\"/_next/static/chunks/ff1a16fafef87110.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d2be314c3ece3fbe.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"IconMark\"]\n11:null\n15:[[\"$\",\"title\",\"0\",{\"children\":\"@lavamoat/snow - npm explorer\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"standardize how to recursively own newborn windows within a web app, from the context of the app itself\"}],[\"$\",\"link\",\"2\",{\"rel\":\"icon\",\"href\":\"/icon-light-32x32.png\",\"media\":\"(prefers-color-scheme: light)\"}],[\"$\",\"link\",\"3\",{\"rel\":\"icon\",\"href\":\"/icon-dark-32x32.png\",\"media\":\"(prefers-color-scheme: dark)\"}],[\"$\",\"link\",\"4\",{\"rel\":\"icon\",\"href\":\"/icon.svg\",\"type\":\"image/svg+xml\"}],[\"$\",\"link\",\"5\",{\"rel\":\"apple-touch-icon\",\"href\":\"/apple-icon.png\"}],[\"$\",\"$L17\",\"6\",{}]]\n"])</script><title>@lavamoat/snow - npm explorer</title><meta name="description" content="standardize how to recursively own newborn windows within a web app, from the context of the app itself"/><link rel="icon" href="/icon-light-32x32.png" media="(prefers-color-scheme: light)"/><link rel="icon" href="/icon-dark-32x32.png" media="(prefers-color-scheme: dark)"/><link rel="icon" href="/icon.svg" type="image/svg+xml"/><link rel="apple-touch-icon" href="/apple-icon.png"/><script >document.querySelectorAll('body link[rel="icon"], body link[rel="apple-touch-icon"]').forEach(el => document.head.appendChild(el))</script><div style="display:none" id="S:2"></div><script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0}; $RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:2","S:2")</script><div style="display:none" id="S:0"></div><script>$RC("B:0","S:0")</script><script>self.__next_f.push([1,"18:I[33485,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"InstallCommands\"]\n"])</script><script>self.__next_f.push([1,"16:[\"$\",\"div\",null,{\"className\":\"space-y-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex flex-col gap-6 lg:flex-row lg:gap-8\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex-1 space-y-4\",\"children\":[[\"$\",\"div\",null,{\"className\":\"flex flex-wrap items-start gap-3\",\"children\":[[\"$\",\"h1\",null,{\"className\":\"font-mono text-2xl font-bold sm:text-3xl\",\"children\":\"@lavamoat/snow\"}],[\"$\",\"div\",null,{\"className\":\"flex flex-wrap items-center gap-2\",\"children\":[[\"$\",\"span\",null,{\"data-slot\":\"badge\",\"className\":\"inline-flex items-center justify-center rounded-md border px-2 py-0.5 text-xs font-medium w-fit whitespace-nowrap shrink-0 [\u0026\u003esvg]:size-3 gap-1 [\u0026\u003esvg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive transition-[color,box-shadow] overflow-hidden border-transparent bg-secondary text-secondary-foreground [a\u0026]:hover:bg-secondary/90 font-mono\",\"children\":[\"v\",\"2.0.4\"]}],\"$undefined\",\"$undefined\"]}]]}],\"$undefined\",[\"$\",\"p\",null,{\"className\":\"text-lg text-muted-foreground\",\"children\":\"standardize how to recursively own newborn windows within a web app, from the context of the app itself\"}],false,[\"$\",\"div\",null,{\"className\":\"flex flex-wrap gap-4 text-sm text-muted-foreground\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-download h-4 w-4\",\"children\":[[\"$\",\"path\",\"ih7n3h\",{\"d\":\"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4\"}],[\"$\",\"polyline\",\"2ggqvy\",{\"points\":\"7 10 12 15 17 10\"}],[\"$\",\"line\",\"1vk2je\",{\"x1\":\"12\",\"x2\":\"12\",\"y1\":\"15\",\"y2\":\"3\"}],\"$undefined\"]}],[\"$\",\"span\",null,{\"className\":\"font-medium text-foreground\",\"children\":\"0\"}],\"/week\"]}],[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-calendar h-4 w-4\",\"children\":[[\"$\",\"path\",\"1cmpym\",{\"d\":\"M8 2v4\"}],[\"$\",\"path\",\"4m81vk\",{\"d\":\"M16 2v4\"}],[\"$\",\"rect\",\"1hopcy\",{\"width\":\"18\",\"height\":\"18\",\"x\":\"3\",\"y\":\"4\",\"rx\":\"2\"}],[\"$\",\"path\",\"8toen8\",{\"d\":\"M3 10h18\"}],\"$undefined\"]}],\"Updated \",\"5 months ago\"]}],[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-scale h-4 w-4\",\"children\":[[\"$\",\"path\",\"7g6ntu\",{\"d\":\"m16 16 3-8 3 8c-.87.65-1.92 1-3 1s-2.13-.35-3-1Z\"}],[\"$\",\"path\",\"ijws7r\",{\"d\":\"m2 16 3-8 3 8c-.87.65-1.92 1-3 1s-2.13-.35-3-1Z\"}],[\"$\",\"path\",\"1b0cd5\",{\"d\":\"M7 21h10\"}],[\"$\",\"path\",\"108xh3\",{\"d\":\"M12 3v18\"}],[\"$\",\"path\",\"3gwbw2\",{\"d\":\"M3 7h2c2 0 5-1 7-2 2 1 5 2 7 2h2\"}],\"$undefined\"]}],\"MIT\"]}],[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5\",\"children\":[\"Unpacked: \",\"306.6 KB\"]}]]}],[\"$\",\"div\",null,{\"className\":\"text-sm\",\"children\":[[\"$\",\"span\",null,{\"className\":\"text-muted-foreground\",\"children\":\"Published by \"}],[\"$\",\"$L5\",null,{\"href\":\"/~kumavis\",\"className\":\"font-medium hover:underline\",\"children\":\"kumavis\"}]]}]]}],[\"$\",\"div\",null,{\"className\":\"w-full space-y-4 lg:w-80\",\"children\":[[\"$\",\"$L18\",null,{\"packageName\":\"@lavamoat/snow\"}],[\"$\",\"div\",null,{\"className\":\"flex flex-wrap gap-2\",\"children\":[[\"$\",\"a\",null,{\"href\":\"https://github.com/lavamoat/snow\",\"target\":\"_blank\",\"rel\":\"noopener noreferrer\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-github mr-1.5 h-4 w-4\",\"children\":[[\"$\",\"path\",\"tonef\",{\"d\":\"M15 22v-4a4.8 4.8 0 0 0-1-3.5c3 0 6-2 6-5.5.08-1.25-.27-2.48-1-3.5.28-1.15.28-2.35 0-3.5 0 0-1 0-3 1.5-2.64-.5-5.36-.5-8 0C6 2 5 2 5 2c-.3 1.15-.3 2.35 0 3.5A5.403 5.403 0 0 0 4 9c0 3.5 3 5.5 6 5.5-.39.49-.68 1.05-.85 1.65-.17.6-.22 1.23-.15 1.85v4\"}],\"$L19\",\"$undefined\"]}],\"Repository\"],\"data-slot\":\"button\",\"className\":\"inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg:not([class*='size-'])]:size-4 shrink-0 [\u0026_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[\u003esvg]:px-2.5\",\"ref\":null}],\"$L1a\",\"$undefined\",\"$L1b\"]}],false]}]]}],\"$L1c\"]}]\n"])</script><script>self.__next_f.push([1,"1d:I[27341,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"Tabs\"]\n1e:I[27341,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"TabsList\"]\n1f:I[27341,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"TabsTrigger\"]\n20:I[27341,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"TabsContent\"]\n21:I[77801,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"ReadmeViewer\"]\n19:[\"$\",\"path\",\"9comsn\",{\"d\":\"M9 18c-4.51 2-5-2-7-2\"}]\n1a:[\"$\",\"a\",null,{\"href\":\"https://lavamoat.github.io/snow/\",\"target\":\"_blank\",\"rel\":\"noopener noreferrer\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-house mr-1.5 h-4 w-4\",\"children\":[[\"$\",\"path\",\"5wwlr5\",{\"d\":\"M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8\"}],[\"$\",\"path\",\"1d0kgt\",{\"d\":\"M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z\"}],\"$undefined\"]}],\"Homepage\"],\"data-slot\":\"button\",\"className\":\"inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg:not([class*='size-'])]:size-4 shrink-0 [\u0026_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[\u003esvg]:px-2.5\",\"ref\":null}]\n1b:[\"$\",\"a\",null,{\"href\":\"https://npmjs.com/package/@lavamoat/snow\",\"target\":\"_blank\",\"rel\":\"noopener noreferrer\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-external-link mr-1.5 h-4 w-4\",\"children\":[[\"$\",\"path\",\"1q9fwt\",{\"d\":\"M15 3h6v6\"}],[\"$\",\"path\",\"gplh6r\",{\"d\":\"M10 14 21 3\"}],[\"$\",\"path\",\"a6xqqp\",{\"d\":\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\"}],\"$undefined\"]}],\"npm\"],\"data-slot\":\"button\",\"className\":\"inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg:not([class*='size-'])]:size-4 shrink-0 [\u0026_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[\u003esvg]:px-2.5\",\"ref\":null}]\n22:T2728,"])</script><script>self.__next_f.push([1,"\u003cdiv align=\"center\"\u003e\n \u003ch1\u003e Snow JS ❄️ \u003c/h1\u003e\n \u003ci\u003e ~ \u003cb\u003eS\u003c/b\u003eecuring \u003cb\u003eN\u003c/b\u003eested \u003cb\u003eO\u003c/b\u003ewnership of \u003cb\u003eW\u003c/b\u003eindows ~ \u003c/i\u003e\n \u003cbr/\u003e\u003cbr/\u003e\n \u003cimg src=\"https://img.shields.io/npm/v/@lavamoat/snow\"/\u003e\n \u003cimg src=\"https://img.shields.io/bundlephobia/min/@lavamoat/snow\"/\u003e\n \u003cimg src=\"https://badges.frapsoft.com/javascript/code/javascript.svg?v=101\" width=\"113\"\u003e\n \u003cimg src=\"https://img.shields.io/npm/dw/@lavamoat/snow\"/\u003e\n \u003cimg src=\"https://img.shields.io/github/license/lavamoat/snow\"/\u003e\n \u003cbr/\u003e\u003cbr/\u003e\n \u003ci\u003e / Keeping an 👀 on these \u003ccode\u003e\u003ciframe\u003e\u003c/code\u003es for ya! / \u003c/i\u003e\n \u003cbr/\u003e\u003cbr/\u003e\n\u003c/div\u003e\n\n\u003e _Snow is the **most advanced** open sourced tool for securing same origin realms in runtime browser apps - **secured** and **easy to use**:_\n\n* Include Snow in your web app's loading html file (or by [requiring it as a module](#Install)):\n```html\n\u003cscript src=\"https://unpkg.com/@lavamoat/snow/snow.prod.js\"\u003e\u003c/script\u003e\n```\n* Pass Snow a callback and Snow will invoke it with **every** new window object in runtime!\n```javascript\nSNOW( win =\u003e console.log('New window detected:', win) )\n```\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg width=\"750\" alt=\"❄️SNOW❄️\" src=\"https://user-images.githubusercontent.com/13243797/219565727-12f00654-a709-4a39-87fc-5a60f643b308.png\"\u003e\n\u003cbr\u003e\u003cbr\u003e\n\u003ci\u003e Snow aspires to standardize how to recursively and \u003cb\u003e securely own newborn windows \u003c/b\u003e (aka iframes/realms) \u003cbr\u003e within a browser web app, \n\u003cb\u003e from the context of the app itself \u003c/b\u003e. \u003c/i\u003e\n\u003c/div\u003e\n\n## About\n\nSnow is an experimental ⚠️ tool coming in the form of a **JavaScript shim** that once is applied to the page exposes an API that when is \nprovided with a callback, will make sure to call it with **every new window** that is being \ninjected to DOM, **before** its creator gets a hold on it.\n\nThis ability exists for extensions (with the `all_frames: true` property), but `Snow` brings it\nto **non extension javascript with the same privileges as the web app**.\n \n\u003e _Read more about Snow and the motivation behind it [here](https://github.com/lavamoat/snow/wiki/Introducing-Snow)_\n\n## 🚨 IMPORTANT UPDATE 🚨\n\nStarting Version [2.0.1](https://github.com/LavaMoat/snow/pull/134) Snow officially doesn't support vulnerabilities that\ncan be protected against by disallowing `unsafe-inline` completely and by correctly using the `object-src` directive to not allow `self`.\n* To learn more why is that, see [section 4](#install).\n\nIn addition, Snow [\"stops playing nice\"](https://github.com/LavaMoat/snow/pull/133) - operations that are considered insecure will be intercepted and cause Snow to throw an exception.\nThis is part of the realization we reached as part of the work on Snow, where \"nice security\" leaves Snow vulnerable, and true security can only be shipped with a more \"aggresive\" approach.\n* To learn more why is that, see [#133](https://github.com/LavaMoat/snow/pull/133).\n\n## [Demo](https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg) - The Snow Challenge! 🏆\n\n\u003cdiv align=\"center\"\u003e\n\u003cimg width=\"759\" alt=\"Screenshot 2023-02-25 at 19 54 33\" src=\"https://user-images.githubusercontent.com/13243797/221372185-eaeea815-b693-43bf-a371-6375ce8e0e8b.png\"\u003e\n\u003c/div\u003e\n\u003cbr\u003e\n\nSnow's challenge is the easiest way to **graspe the power of Snow.** \n\nHere we have a serverless [demo app](https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg), which installs and **uses Snow to disable the functionality of the `alert` function** for all same origin realms.\n \nIn other words, the app uses Snow to make sure **no one can call the `alert` function**, not even when:\n* Trying to create an `\u003ciframe\u003e` and use its inner window's `alert`;\n* Trying to call the `alert` function from the console (even self-XSS won't help you!);\n* Trying to open a new tab and use its `alert`.\n \nHence, the rulls are very simple - **visit the [app](https://lavamoat.github.io/snow/demo/) and pop an alert! 😉**\n \nIf you manage to bypass Snow and pop an alert message - **help us** by opening an issue so we could continue to **improve Snow's security**!\n \n## Usage\n\n```javascript\n// API\nSNOW(cb = (win) =\u003e { /* LOGIC */ });\n\n\n// example, disable alert API in the webpage completely\nSNOW((win) =\u003e {\n win.alert = (msg) =\u003e {\n console.log('alert is disabled! msg is: ' + msg);\n };\n});\n```\n\n## Install\n\nThe latest `snow` [production version](https://raw.githubusercontent.com/lavamoat/snow/main/snow.prod.js) is included in the official repo\nand also in [upkg cdn](https://unpkg.com/@lavamoat/snow/snow.prod.js), so in order to\ninstall `snow` in the website, simply place it wherever and serve it to the website as-is:\n\n```html\n\u003cscript src=\"https://unpkg.com/@lavamoat/snow/snow.prod.js\"\u003e\u003c/script\u003e\n```\n\nAfter this line, window should expose `window.SNOW` API for the\nrest of the scripts in the website to use.\n\nNot like standard third party libraries, `snow` has special requirements (security-wise) in order for it to play its role securely.\n\n\u003e **👇 It is highly important to be aware of them when integrating Snow into an app to gain full security - READ CAREFULLY 👇:**\n\n1. **It has to run as the first piece of javascript that runs in the webpage** - otherwise any\n other javascript code will have the ability to bypass `snow` and cancel \n its purpose completely (that's why `snow` can never overpower extensions).\n In order to achieve that, when loading via a script tag it must load script synchronously (do not use `async=true`!).\n\n2. **It has to be served as-is** - If it goes through any bundlers that might change it,\n the modified version might contain flaws that attackers might use to cancel its effect (for further\n explanation see [natives](https://github.com/lavamoat/snow/wiki/Introducing-Snow#natives) section).\n\n3. **Snow needs to be set and called in every HTML page served from your web app** - Even though this is the attack vector\n Snow tries to protect the app against, there are types of attacks Snow won't be able to defend against (which is why\n we want Snow to become a native browser feature so bad!). This mainly refers to the [#73 discovery](https://github.com/LavaMoat/snow/issues/73).\n The only way to defend the app against such an attack it to make sure all HTML files served by the app load Snow themselves.\n Does this make Snow useless? No - there are planty other types of attacks Snow defends your app against.\n\n4. **Most importantly, it's highly vulnerable without minimal help from CSP** - As of version 2.0.1 the project will\n seize to attempt to defend against vulnerabilities that aren't possible to exploit when \n (a) `unsafe-inline` isn't allowed and (b) `object-src` to `self` isn't allowed.\n This is because (a) defending against string-JS attacks is basically an endless task and probably impossible, and\n (b) `object`/`embed` elements behaviour is also too unpredictable while these elements shouldn't be even used in the\n first place. Snow will do its best regardless of what CSP is applied - **use at your own risk!** \n * please learn more about this ☝️ at [#118](https://github.com/LavaMoat/snow/pull/118/) \u0026 [#133](https://github.com/LavaMoat/snow/pull/133/)\n\n\n`SNOW` API can also be required as part of a bundle instead of a script tag:\n\n```\nyarn add @lavamoat/snow\n```\n\n```javascript\nconst snow = require('@lavamoat/snow');\n```\n\n## Contribute\n\nThis project is an important POC aspiring to standardize how windows should be hermetically\nhandled, however it is not yet production ready.\n\n`snow` eventually is a shim that comes to both demonstrate and utilize the API we wish to see builtin to browsers in the future. \nUntil `snow` becomes a platform builtin API, we have to attempt to overcome several challenges that are significantly harder to do so in pure javascript:\n\n### Support\n\n`snow` supports Chrome, Firefox, Safari and all other Chromium based browsers (Opera, Edge, Brave, etc).\n\n### Performance\n\nAchieving a hermetic solution costs in performance. Injecting this script into some major\nwebsites went smoothly while with some others it caused them some performance issues.\n\n### Security\n\nAlthough this project takes the hermetic concept very seriously and massively tests for\npotential flaws, `snow` might potentially still have flaws which might enable attackers\nto bypass its hooks.\n\nBottom line - `snow` might have security vulnerabilities!\n\nHopefully in the future `snow` will become a builtin API provided by the browser. \nAchieving that goal will allow security assurance - such functionality will be safer to implement \non behalf of the browser rather than the web app.\n\n### Tests\n\nIn order to assure security, there are many tests that verify that `snow`\nis fully hermetic as promised - everything that `snow` supports is fully tested.\n\nThe tests mainly try to bypass `snow` in any possible way.\n\nIf you found a vulnerability in `snow`, open a PR with a test that demonstrates it (or just let us know, and we'll do it).\n\n### Help\n\nHelp with promoting any of the topics above is very much appreciated in order for this project\nto become production ready and reshape how hermetic window hooking should look like!\n\n## Troubleshooting\n\nIn [log.js](https://github.com/LavaMoat/snow/blob/main/src/log.js) file you can find references\nto issues you might encounter using snow. \nIf you do, you should see an error/warning thrown to console in your application with a reference\nto the relevant issue thread.\n\nIn each thread a discussion around the issue is being made in order to better solve it, so please\nshare your experience with the issue in order for us to solve it in the best way possible.\n\nIf you encounter an issue that is not being handled by snow correctly, please open a new one.\n\n## Supporters\n\nFunded by [Consensys 💙](https://github.com/consensys)\n\nMaintained and developed by [MetaMask 🦊](https://github.com/MetaMask)\n \nPart of the [LavaMoat 🌋](https://github.com/LavaMoat) Javascript security toolbox\n\nInvented and developed by [Gal Weizman 👋🏻](https://weizmangal.com/)\n"])</script><script>self.__next_f.push([1,"1c:[\"$\",\"$L1d\",null,{\"defaultValue\":\"readme\",\"className\":\"w-full\",\"children\":[[\"$\",\"$L1e\",null,{\"children\":[[\"$\",\"$L1f\",null,{\"value\":\"readme\",\"children\":\"Readme\"}],[\"$\",\"$L1f\",null,{\"value\":\"dependencies\",\"children\":[\"Dependencies\",[\"$\",\"span\",null,{\"className\":\"ml-1.5 text-xs text-muted-foreground\",\"children\":[\"(\",0,\")\"]}]]}],[\"$\",\"$L1f\",null,{\"value\":\"versions\",\"children\":[\"Versions\",[\"$\",\"span\",null,{\"className\":\"ml-1.5 text-xs text-muted-foreground\",\"children\":[\"(\",10,\")\"]}]]}]]}],[\"$\",\"$L20\",null,{\"value\":\"readme\",\"className\":\"mt-6\",\"children\":[\"$\",\"$L21\",null,{\"readme\":\"$22\"}]}],\"$L23\",\"$L24\"]}]\n"])</script><script>self.__next_f.push([1,"32:I[7860,[\"/_next/static/chunks/d25c1c87321c1e5e.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/d23d08e0b5d1d215.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\",\"/_next/static/chunks/ae55acb14c32e044.js?dpl=dpl_5VNVLvSu6UbYcDkvZSHQ251MMiDd\"],\"VersionList\"]\n"])</script><script>self.__next_f.push([1,"23:[\"$\",\"$L20\",null,{\"value\":\"dependencies\",\"className\":\"mt-6\",\"children\":[\"$\",\"div\",null,{\"className\":\"grid gap-6 lg:grid-cols-2\",\"children\":[false,false,[\"$\",\"div\",null,{\"data-slot\":\"card\",\"className\":\"bg-card text-card-foreground flex flex-col gap-6 rounded-xl border shadow-sm py-4 lg:col-span-2\",\"children\":[[\"$\",\"div\",null,{\"data-slot\":\"card-header\",\"className\":\"@container/card-header grid auto-rows-min grid-rows-[auto_auto] items-start gap-2 px-6 has-data-[slot=card-action]:grid-cols-[1fr_auto] [.border-b]:pb-6 pb-2\",\"children\":[\"$\",\"div\",null,{\"data-slot\":\"card-title\",\"className\":\"font-semibold flex items-center gap-2 text-base\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-wrench h-4 w-4\",\"children\":[[\"$\",\"path\",\"cbrjhi\",{\"d\":\"M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z\"}],\"$undefined\"]}],\"Dev Dependencies\",[\"$\",\"span\",null,{\"data-slot\":\"badge\",\"className\":\"inline-flex items-center justify-center rounded-md border px-2 py-0.5 font-medium w-fit whitespace-nowrap shrink-0 [\u0026\u003esvg]:size-3 gap-1 [\u0026\u003esvg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive transition-[color,box-shadow] overflow-hidden border-transparent bg-secondary text-secondary-foreground [a\u0026]:hover:bg-secondary/90 ml-auto text-xs\",\"children\":14}]]}]}],[\"$\",\"div\",null,{\"data-slot\":\"card-content\",\"className\":\"px-6\",\"children\":[\"$\",\"div\",null,{\"className\":\"grid gap-1 sm:grid-cols-2 lg:grid-cols-3\",\"children\":[[\"$\",\"$L5\",\"@babel/core\",{\"href\":\"/package/%40babel%2Fcore\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"@babel/core\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.13.15\"}]]}],[\"$\",\"$L5\",\"@babel/preset-env\",{\"href\":\"/package/%40babel%2Fpreset-env\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"@babel/preset-env\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.13.15\"}]]}],[\"$\",\"$L5\",\"@wdio/cli\",{\"href\":\"/package/%40wdio%2Fcli\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[\"$L25\",\"$undefined\"]}],\"@wdio/cli\"]}],\"$L26\"]}],\"$L27\",\"$L28\",\"$L29\",\"$L2a\",\"$L2b\",\"$L2c\",\"$L2d\",\"$L2e\",\"$L2f\",\"$L30\",\"$L31\"]}]}]]}]]}]}]\n"])</script><script>self.__next_f.push([1,"24:[\"$\",\"$L20\",null,{\"value\":\"versions\",\"className\":\"mt-6\",\"children\":[\"$\",\"$L32\",null,{\"packageName\":\"@lavamoat/snow\",\"versions\":[{\"version\":\"2.0.4\",\"date\":\"2025-04-09T08:51:55.832Z\",\"deprecated\":\"$undefined\"},{\"version\":\"2.0.3\",\"date\":\"2024-10-28T12:52:13.432Z\",\"deprecated\":\"$undefined\"},{\"version\":\"2.0.2\",\"date\":\"2024-09-25T10:36:51.062Z\",\"deprecated\":\"$undefined\"},{\"version\":\"2.0.1\",\"date\":\"2023-08-03T16:11:21.529Z\",\"deprecated\":\"$undefined\"},{\"version\":\"2.0.0\",\"date\":\"2023-07-18T10:51:20.689Z\",\"deprecated\":\"This version of Snow has been deprecated, read more at https://github.com/LavaMoat/snow/pull/76\"},{\"version\":\"1.5.0\",\"date\":\"2023-03-05T11:09:30.897Z\",\"deprecated\":\"$undefined\"},{\"version\":\"1.4.1\",\"date\":\"2023-01-15T13:51:19.252Z\",\"deprecated\":\"$undefined\"},{\"version\":\"1.4.0\",\"date\":\"2023-01-11T19:44:39.522Z\",\"deprecated\":\"$undefined\"},{\"version\":\"1.3.0\",\"date\":\"2022-12-05T19:18:10.895Z\",\"deprecated\":\"$undefined\"},{\"version\":\"1.2.1\",\"date\":\"2022-11-23T20:05:29.947Z\",\"deprecated\":\"$undefined\"}],\"currentVersion\":\"2.0.4\"}]}]\n"])</script><div style="display:none" id="S:1"><div class="space-y-8"><div class="flex flex-col gap-6 lg:flex-row lg:gap-8"><div class="flex-1 space-y-4"><div class="flex flex-wrap items-start gap-3"><h1 class="font-mono text-2xl font-bold sm:text-3xl">@lavamoat/snow</h1><div class="flex flex-wrap items-center gap-2"><span data-slot="badge" class="inline-flex items-center justify-center rounded-md border px-2 py-0.5 text-xs font-medium w-fit whitespace-nowrap shrink-0 [&>svg]:size-3 gap-1 [&>svg]:pointer-events-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive transition-[color,box-shadow] overflow-hidden border-transparent bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 font-mono">v2.0.4</span></div></div><p class="text-lg text-muted-foreground">standardize how to recursively own newborn windows within a web app, from the context of the app itself</p><div class="flex flex-wrap gap-4 text-sm text-muted-foreground"><span class="flex items-center gap-1.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-download h-4 w-4"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"></path><polyline points="7 10 12 15 17 10"></polyline><line x1="12" x2="12" y1="15" y2="3"></line></svg><span class="font-medium text-foreground">0</span>/week</span><span class="flex items-center gap-1.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-calendar h-4 w-4"><path d="M8 2v4"></path><path d="M16 2v4"></path><rect width="18" height="18" x="3" y="4" rx="2"></rect><path d="M3 10h18"></path></svg>Updated 5 months ago</span><span class="flex items-center gap-1.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-scale h-4 w-4"><path d="m16 16 3-8 3 8c-.87.65-1.92 1-3 1s-2.13-.35-3-1Z"></path><path d="m2 16 3-8 3 8c-.87.65-1.92 1-3 1s-2.13-.35-3-1Z"></path><path d="M7 21h10"></path><path d="M12 3v18"></path><path d="M3 7h2c2 0 5-1 7-2 2 1 5 2 7 2h2"></path></svg>MIT</span><span class="flex items-center gap-1.5">Unpacked: 306.6 KB</span></div><div class="text-sm"><span class="text-muted-foreground">Published by </span><a class="font-medium hover:underline" href="/~kumavis">kumavis</a></div></div><div class="w-full space-y-4 lg:w-80"><div class="rounded-lg border bg-card"><div dir="ltr" data-orientation="horizontal" data-slot="tabs" class="flex flex-col gap-2"><div role="tablist" aria-orientation="horizontal" data-slot="tabs-list" class="text-muted-foreground inline-flex h-9 items-center w-full justify-start rounded-none border-b bg-transparent p-0" tabindex="-1" data-orientation="horizontal" style="outline:none"><button type="button" role="tab" aria-selected="true" aria-controls="radix-_R_36av5ubrb_-content-npm" data-state="active" id="radix-_R_36av5ubrb_-trigger-npm" data-slot="tabs-trigger" class="dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 border px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 rounded-none border-b-2 border-transparent data-[state=active]:border-primary data-[state=active]:bg-transparent" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">npm</button><button type="button" role="tab" aria-selected="false" aria-controls="radix-_R_36av5ubrb_-content-yarn" data-state="inactive" id="radix-_R_36av5ubrb_-trigger-yarn" data-slot="tabs-trigger" class="dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 border px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 rounded-none border-b-2 border-transparent data-[state=active]:border-primary data-[state=active]:bg-transparent" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">yarn</button><button type="button" role="tab" aria-selected="false" aria-controls="radix-_R_36av5ubrb_-content-pnpm" data-state="inactive" id="radix-_R_36av5ubrb_-trigger-pnpm" data-slot="tabs-trigger" class="dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 border px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 rounded-none border-b-2 border-transparent data-[state=active]:border-primary data-[state=active]:bg-transparent" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">pnpm</button><button type="button" role="tab" aria-selected="false" aria-controls="radix-_R_36av5ubrb_-content-bun" data-state="inactive" id="radix-_R_36av5ubrb_-trigger-bun" data-slot="tabs-trigger" class="dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 border px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 rounded-none border-b-2 border-transparent data-[state=active]:border-primary data-[state=active]:bg-transparent" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">bun</button></div><div data-state="active" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_36av5ubrb_-trigger-npm" id="radix-_R_36av5ubrb_-content-npm" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-0" style="animation-duration:0s"><div class="flex items-center justify-between gap-2 p-3"><code class="flex-1 overflow-x-auto whitespace-nowrap font-mono text-sm">npm install @lavamoat/snow</code><button data-slot="button" class="inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50 size-9 h-8 w-8 shrink-0"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-copy h-4 w-4"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg></button></div></div><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_36av5ubrb_-trigger-yarn" hidden="" id="radix-_R_36av5ubrb_-content-yarn" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-0"></div><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_36av5ubrb_-trigger-pnpm" hidden="" id="radix-_R_36av5ubrb_-content-pnpm" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-0"></div><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_36av5ubrb_-trigger-bun" hidden="" id="radix-_R_36av5ubrb_-content-bun" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-0"></div></div></div><div class="flex flex-wrap gap-2"><a href="https://github.com/lavamoat/snow" target="_blank" rel="noopener noreferrer" data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-github mr-1.5 h-4 w-4"><path d="M15 22v-4a4.8 4.8 0 0 0-1-3.5c3 0 6-2 6-5.5.08-1.25-.27-2.48-1-3.5.28-1.15.28-2.35 0-3.5 0 0-1 0-3 1.5-2.64-.5-5.36-.5-8 0C6 2 5 2 5 2c-.3 1.15-.3 2.35 0 3.5A5.403 5.403 0 0 0 4 9c0 3.5 3 5.5 6 5.5-.39.49-.68 1.05-.85 1.65-.17.6-.22 1.23-.15 1.85v4"></path><path d="M9 18c-4.51 2-5-2-7-2"></path></svg>Repository</a><a href="https://lavamoat.github.io/snow/" target="_blank" rel="noopener noreferrer" data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-house mr-1.5 h-4 w-4"><path d="M15 21v-8a1 1 0 0 0-1-1h-4a1 1 0 0 0-1 1v8"></path><path d="M3 10a2 2 0 0 1 .709-1.528l7-5.999a2 2 0 0 1 2.582 0l7 5.999A2 2 0 0 1 21 10v9a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"></path></svg>Homepage</a><a href="https://npmjs.com/package/@lavamoat/snow" target="_blank" rel="noopener noreferrer" data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-external-link mr-1.5 h-4 w-4"><path d="M15 3h6v6"></path><path d="M10 14 21 3"></path><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path></svg>npm</a></div></div></div><div dir="ltr" data-orientation="horizontal" data-slot="tabs" class="flex flex-col gap-2 w-full"><div role="tablist" aria-orientation="horizontal" data-slot="tabs-list" class="bg-muted text-muted-foreground inline-flex h-9 w-fit items-center justify-center rounded-lg p-[3px]" tabindex="-1" data-orientation="horizontal" style="outline:none"><button type="button" role="tab" aria-selected="true" aria-controls="radix-_R_aav5ubrb_-content-readme" data-state="active" id="radix-_R_aav5ubrb_-trigger-readme" data-slot="tabs-trigger" class="data-[state=active]:bg-background dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">Readme</button><button type="button" role="tab" aria-selected="false" aria-controls="radix-_R_aav5ubrb_-content-dependencies" data-state="inactive" id="radix-_R_aav5ubrb_-trigger-dependencies" data-slot="tabs-trigger" class="data-[state=active]:bg-background dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">Dependencies<span class="ml-1.5 text-xs text-muted-foreground">(0)</span></button><button type="button" role="tab" aria-selected="false" aria-controls="radix-_R_aav5ubrb_-content-versions" data-state="inactive" id="radix-_R_aav5ubrb_-trigger-versions" data-slot="tabs-trigger" class="data-[state=active]:bg-background dark:data-[state=active]:text-foreground focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:outline-ring dark:data-[state=active]:border-input dark:data-[state=active]:bg-input/30 text-foreground dark:text-muted-foreground inline-flex h-[calc(100%-1px)] flex-1 items-center justify-center gap-1.5 rounded-md border border-transparent px-2 py-1 text-sm font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] focus-visible:outline-1 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:shadow-sm [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4" tabindex="-1" data-orientation="horizontal" data-radix-collection-item="">Versions<span class="ml-1.5 text-xs text-muted-foreground">(10)</span></button></div><div data-state="active" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_aav5ubrb_-trigger-readme" id="radix-_R_aav5ubrb_-content-readme" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-6" style="animation-duration:0s"><div class="relative"><div class="prose prose-sm dark:prose-invert max-w-none overflow-hidden rounded-lg border p-6" style="max-height:500px"><p><div align="center"><br /> <h1> Snow JS ❄️ </h1><br /> <i> ~ <b>S</b>ecuring <b>N</b>ested <b>O</b>wnership of <b>W</b>indows ~ </i><br /> <br/><br/><br /> <img src="https://img.shields.io/npm/v/@lavamoat/snow"/><br /> <img src="https://img.shields.io/bundlephobia/min/@lavamoat/snow"/><br /> <img src="https://badges.frapsoft.com/javascript/code/javascript.svg?v=101" width="113"><br /> <img src="https://img.shields.io/npm/dw/@lavamoat/snow"/><br /> <img src="https://img.shields.io/github/license/lavamoat/snow"/><br /> <br/><br/><br /> <i> / Keeping an 👀 on these <code><iframe></code>s for ya! / </i><br /> <br/><br/><br /></div></p><p class="my-3">> _Snow is the <strong>most advanced</strong> open sourced tool for securing same origin realms in runtime browser apps - <strong>secured</strong> and <strong>easy to use</strong>:_</p><p class="my-3">* Include Snow in your web app's loading html file (or by <a href="#Install" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">requiring it as a module</a>):<br />``<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">html<br /><script src="https://unpkg.com/@lavamoat/snow/snow.prod.js"></script><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />* Pass Snow a callback and Snow will invoke it with <strong>every</strong> new window object in runtime!<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />SNOW( win => console.log('New window detected:', win) )<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><div align="center"><br /><img width="750" alt="❄️SNOW❄️" src="https://user-images.githubusercontent.com/13243797/219565727-12f00654-a709-4a39-87fc-5a60f643b308.png"><br /><br><br><br /><i> Snow aspires to standardize how to recursively and <b> securely own newborn windows </b> (aka iframes/realms) <br> within a browser web app, <br /><b> from the context of the app itself </b>. </i><br /></div></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">About</h2></p><p class="my-3">Snow is an experimental ⚠️ tool coming in the form of a <strong>JavaScript shim</strong> that once is applied to the page exposes an API that when is <br />provided with a callback, will make sure to call it with <strong>every new window</strong> that is being <br />injected to DOM, <strong>before</strong> its creator gets a hold on it.</p><p class="my-3">This ability exists for extensions (with the </code>all_frames: true<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> property), but </code>Snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> brings it<br />to <strong>non extension javascript with the same privileges as the web app</strong>.<br /> <br />> _Read more about Snow and the motivation behind it <a href="https://github.com/lavamoat/snow/wiki/Introducing-Snow" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">here</a>_</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">🚨 IMPORTANT UPDATE 🚨</h2></p><p class="my-3">Starting Version <a href="https://github.com/LavaMoat/snow/pull/134" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">2.0.1</a> Snow officially doesn't support vulnerabilities that<br />can be protected against by disallowing </code>unsafe-inline<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> completely and by correctly using the </code>object-src<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> directive to not allow </code>self<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">.<br />* To learn more why is that, see <a href="#install" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">section 4</a>.</p><p class="my-3">In addition, Snow <a href="https://github.com/LavaMoat/snow/pull/133" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">"stops playing nice"</a> - operations that are considered insecure will be intercepted and cause Snow to throw an exception.<br />This is part of the realization we reached as part of the work on Snow, where "nice security" leaves Snow vulnerable, and true security can only be shipped with a more "aggresive" approach.<br />* To learn more why is that, see <a href="https://github.com/LavaMoat/snow/pull/133" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#133</a>.</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3"><a href="https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Demo</a> - The Snow Challenge! 🏆</h2></p><p class="my-3"><div align="center"><br /><img width="759" alt="Screenshot 2023-02-25 at 19 54 33" src="https://user-images.githubusercontent.com/13243797/221372185-eaeea815-b693-43bf-a371-6375ce8e0e8b.png"><br /></div><br /><br></p><p class="my-3">Snow's challenge is the easiest way to <strong>graspe the power of Snow.</strong> </p><p class="my-3">Here we have a serverless <a href="https://lavamoat.github.io/snow/demo/#self-xss-challenge-msg" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">demo app</a>, which installs and <strong>uses Snow to disable the functionality of the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function</strong> for all same origin realms.<br /> <br />In other words, the app uses Snow to make sure <strong>no one can call the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function</strong>, not even when:<br />* Trying to create an </code><iframe><code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> and use its inner window's </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">;<br />* Trying to call the </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> function from the console (even self-XSS won't help you!);<br />* Trying to open a new tab and use its </code>alert<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">.<br /> <br />Hence, the rulls are very simple - <strong>visit the <a href="https://lavamoat.github.io/snow/demo/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">app</a> and pop an alert! 😉</strong><br /> <br />If you manage to bypass Snow and pop an alert message - <strong>help us</strong> by opening an issue so we could continue to <strong>improve Snow's security</strong>!<br /> <br /><h2 class="text-xl font-semibold mt-5 mb-3">Usage</h2></p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />// API<br />SNOW(cb = (win) => { /<em> LOGIC </em>/ });</p><p class="my-3"><br />// example, disable alert API in the webpage completely<br />SNOW((win) => {<br /> win.alert = (msg) => {<br /> console.log('alert is disabled! msg is: ' + msg);<br /> };<br />});<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Install</h2></p><p class="my-3">The latest </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> <a href="https://raw.githubusercontent.com/lavamoat/snow/main/snow.prod.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">production version</a> is included in the official repo<br />and also in <a href="https://unpkg.com/@lavamoat/snow/snow.prod.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">upkg cdn</a>, so in order to<br />install </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> in the website, simply place it wherever and serve it to the website as-is:</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">html<br /><script src="https://unpkg.com/@lavamoat/snow/snow.prod.js"></script><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3">After this line, window should expose </code>window.SNOW<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> API for the<br />rest of the scripts in the website to use.</p><p class="my-3">Not like standard third party libraries, </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> has special requirements (security-wise) in order for it to play its role securely.</p><p class="my-3">> <strong>👇 It is highly important to be aware of them when integrating Snow into an app to gain full security - READ CAREFULLY 👇:</strong></p><p class="my-3">1. <strong>It has to run as the first piece of javascript that runs in the webpage</strong> - otherwise any<br /> other javascript code will have the ability to bypass </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> and cancel <br /> its purpose completely (that's why </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> can never overpower extensions).<br /> In order to achieve that, when loading via a script tag it must load script synchronously (do not use </code>async=true<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">!).</p><p class="my-3">2. <strong>It has to be served as-is</strong> - If it goes through any bundlers that might change it,<br /> the modified version might contain flaws that attackers might use to cancel its effect (for further<br /> explanation see <a href="https://github.com/lavamoat/snow/wiki/Introducing-Snow#natives" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">natives</a> section).</p><p class="my-3">3. <strong>Snow needs to be set and called in every HTML page served from your web app</strong> - Even though this is the attack vector<br /> Snow tries to protect the app against, there are types of attacks Snow won't be able to defend against (which is why<br /> we want Snow to become a native browser feature so bad!). This mainly refers to the <a href="https://github.com/LavaMoat/snow/issues/73" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#73 discovery</a>.<br /> The only way to defend the app against such an attack it to make sure all HTML files served by the app load Snow themselves.<br /> Does this make Snow useless? No - there are planty other types of attacks Snow defends your app against.</p><p class="my-3">4. <strong>Most importantly, it's highly vulnerable without minimal help from CSP</strong> - As of version 2.0.1 the project will<br /> seize to attempt to defend against vulnerabilities that aren't possible to exploit when <br /> (a) </code>unsafe-inline<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> isn't allowed and (b) </code>object-src<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> to </code>self<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> isn't allowed.<br /> This is because (a) defending against string-JS attacks is basically an endless task and probably impossible, and<br /> (b) </code>object<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">/</code>embed<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> elements behaviour is also too unpredictable while these elements shouldn't be even used in the<br /> first place. Snow will do its best regardless of what CSP is applied - <strong>use at your own risk!</strong> <br /> * please learn more about this ☝️ at <a href="https://github.com/LavaMoat/snow/pull/118/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#118</a> & <a href="https://github.com/LavaMoat/snow/pull/133/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">#133</a></p><p class="my-3"><br /></code>SNOW<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> API can also be required as part of a bundle instead of a script tag:</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />yarn add @lavamoat/snow<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">javascript<br />const snow = require('@lavamoat/snow');<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Contribute</h2></p><p class="my-3">This project is an important POC aspiring to standardize how windows should be hermetically<br />handled, however it is not yet production ready.</p><p class="my-3"></code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> eventually is a shim that comes to both demonstrate and utilize the API we wish to see builtin to browsers in the future. <br />Until </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> becomes a platform builtin API, we have to attempt to overcome several challenges that are significantly harder to do so in pure javascript:</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3"></code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> supports Chrome, Firefox, Safari and all other Chromium based browsers (Opera, Edge, Brave, etc).</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Achieving a hermetic solution costs in performance. Injecting this script into some major<br />websites went smoothly while with some others it caused them some performance issues.</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Although this project takes the hermetic concept very seriously and massively tests for<br />potential flaws, </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> might potentially still have flaws which might enable attackers<br />to bypass its hooks.</p><p class="my-3">Bottom line - </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> might have security vulnerabilities!</p><p class="my-3">Hopefully in the future </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> will become a builtin API provided by the browser. <br />Achieving that goal will allow security assurance - such functionality will be safer to implement <br />on behalf of the browser rather than the web app.</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">In order to assure security, there are many tests that verify that </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />is fully hermetic as promised - everything that </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> supports is fully tested.</p><p class="my-3">The tests mainly try to bypass </code>snow<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> in any possible way.</p><p class="my-3">If you found a vulnerability in </code>snow`, open a PR with a test that demonstrates it (or just let us know, and we'll do it).</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Help with promoting any of the topics above is very much appreciated in order for this project<br />to become production ready and reshape how hermetic window hooking should look like!</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Troubleshooting</h2></p><p class="my-3">In <a href="https://github.com/LavaMoat/snow/blob/main/src/log.js" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">log.js</a> file you can find references<br />to issues you might encounter using snow. <br />If you do, you should see an error/warning thrown to console in your application with a reference<br />to the relevant issue thread.</p><p class="my-3">In each thread a discussion around the issue is being made in order to better solve it, so please<br />share your experience with the issue in order for us to solve it in the best way possible.</p><p class="my-3">If you encounter an issue that is not being handled by snow correctly, please open a new one.</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">Supporters</h2></p><p class="my-3">Funded by <a href="https://github.com/consensys" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Consensys 💙</a></p><p class="my-3">Maintained and developed by <a href="https://github.com/MetaMask" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">MetaMask 🦊</a><br /> <br />Part of the <a href="https://github.com/LavaMoat" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">LavaMoat 🌋</a> Javascript security toolbox</p><p class="my-3">Invented and developed by <a href="https://weizmangal.com/" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">Gal Weizman 👋🏻</a><br /></p></div><div class="flex justify-center absolute inset-x-0 bottom-0 bg-gradient-to-t from-background via-background to-transparent pb-4 pt-16"><button data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down mr-1 h-4 w-4"><path d="m6 9 6 6 6-6"></path></svg>Show more</button></div></div></div><template id="P:3"></template><template id="P:4"></template></div></div></div><script>self.__next_f.push([1,"25:[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}]\n26:[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.5.3\"}]\n27:[\"$\",\"$L5\",\"@wdio/local-runner\",{\"href\":\"/package/%40wdio%2Flocal-runner\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"@wdio/local-runner\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.5.5\"}]]}]\n28:[\"$\",\"$L5\",\"@wdio/mocha-framework\",{\"href\":\"/package/%40wdio%2Fmocha-framework\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"@wdio/mocha-framework\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.5.3\"}]]}]\n29:[\"$\",\"$L5\",\"@wdio/spec-reporter\",{\"href\":\"/package/%40wdio%2Fspec-reporter\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"@wdio/spec-reporter\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^7.5.3\"}]]}]\n2a:[\"$\",\"$L5\",\"babel-loader\",{\"href\":\"/package/babel-loader\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"babel-loader\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^8.2.2\"}]]}]\n2b:[\"$\",\"$L5\",\"chromedriver\",{\"href\":\"/package/chromedriver\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\""])</script><script>self.__next_f.push([1,":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"chromedriver\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^129.0.0\"}]]}]\n2c:[\"$\",\"$L5\",\"geckodriver\",{\"href\":\"/package/geckodriver\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"geckodriver\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^3.2.0\"}]]}]\n2d:[\"$\",\"$L5\",\"wdio-chromedriver-service\",{\"href\":\"/package/wdio-chromedriver-service\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"wdio-chromedriver-service\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"7.0.0\"}]]}]\n2e:[\"$\",\"$L5\",\"wdio-geckodriver-service\",{\"href\":\"/package/wdio-geckodriver-service\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"wdio-geckodriver-service\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^4.0.0\"}]]}]\n2f:[\"$\",\"$L5\",\"wdio-safaridriver-service\",{\"href\":\"/package/wdio-safaridriver-service\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"wdio-safaridriver-service\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^2.0.0\"}]]}]\n30:[\"$\",\"$L5\",\"webpack\",{\"href\":\"/package/webpack\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate "])</script><script>self.__next_f.push([1,"font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"webpack\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^5.33.2\"}]]}]\n31:[\"$\",\"$L5\",\"webpack-cli\",{\"href\":\"/package/webpack-cli\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"webpack-cli\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^4.6.0\"}]]}]\n"])</script><div hidden id="S:3"><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_aav5ubrb_-trigger-dependencies" hidden="" id="radix-_R_aav5ubrb_-content-dependencies" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-6"></div></div><script>$RS=function(a,b){a=document.getElementById(a);b=document.getElementById(b);for(a.parentNode.removeChild(a);a.firstChild;)b.parentNode.insertBefore(a.firstChild,b);b.parentNode.removeChild(b)};$RS("S:3","P:3")</script><div hidden id="S:4"><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_aav5ubrb_-trigger-versions" hidden="" id="radix-_R_aav5ubrb_-content-versions" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-6"></div></div><script>$RS("S:4","P:4")</script><script>$RC("B:1","S:1")</script></body></html>