Gathering detailed insights and metrics for @metamask/onboarding
Gathering detailed insights and metrics for @metamask/onboarding
Installations
npm install @metamask/onboardingScore
99.1
Supply Chain
98
Quality
82.6
Maintenance
100
Vulnerability
99.6
License
Developer
MetaMask
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
Typescript Support
Yes
Node Version
14.15.1
NPM Version
6.14.8
Statistics
145 Stars
70 Commits
53 Forks
43 Watching
2 Branches
268 Contributors
Updated on 23 Sept 2024
Bundle Size
30.34 kB
Minified
7.52 kB
Minified + Gzipped
Languages
TypeScript (83.19%)
JavaScript (16.81%)
Total Downloads
Cumulative downloads
Total Downloads
6,296,840
Last day
-8.3%
29,517
Compared to previous day
Last week
7.2%
172,542
Compared to previous week
Last month
2.9%
702,947
Compared to previous month
Last year
795.2%
5,026,715
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Dev Dependencies
17
eslintrollupprettiertypescripteslint-plugin-nodeeslint-plugin-importeslint-config-prettiereslint-plugin-prettier@lavamoat/allow-scripts@metamask/eslint-config@metamask/auto-changelog@typescript-eslint/parserrollup-plugin-typescript2@rollup/plugin-node-resolve@metamask/eslint-config-nodejs@typescript-eslint/eslint-plugin@metamask/eslint-config-typescript
Versions
MetaMask Onboarding
This library is used to help onboard new MetaMask users. It allows you to ask the MetaMask extension to redirect users back to your page after onboarding has finished.
This library will register the current page as having initiated onboarding, so that MetaMask knows where to redirect the user after onboarding. Note that the page will be automatically reloaded a single time once a MetaMask installation is detected, in order to facilitate this registration.
Installation
@metamask/onboarding is made available as either a CommonJS module, and ES6 module, or an ES5 bundle.
- ES6 module:
import MetaMaskOnboarding from '@metamask/onboarding' - ES5 module:
const MetaMaskOnboarding = require('@metamask/onboarding') - ES5 bundle:
dist/metamask-onboarding.bundle.js(this can be included directly in a page)
Usage
See § Onboarding Library on the MetaMask Docs website for examples.
API
Assuming import MetaMaskOnboarding from '@metamask/onboarding', the following API is available.
Static methods
MetaMaskOnboarding.isMetaMaskInstalled()
Returns true if a MetaMask-like provider is detected, or false otherwise. Note that we don't provide any guarantee that this is correct, as non-MetaMask wallets can disguise themselves as MetaMask.
Static properties
MetaMaskOnboarding.FORWARDER_MODE
A set of constants for each of the available forwarder modes.
| Constant | Description |
|---|---|
INJECT | Inject a iframe to that will refresh until MetaMask has installed |
OPEN_TAB | Open a tab to a new page that will refresh until MetaMask has installed—this is only useful if the client app has disallowed iframes |
Constructor
new MetaMaskOnboarding()
The constructor accepts an optional options bag with the following:
| Option | Description |
|---|---|
forwarderOrigin | Override the forwarder URL, useful for testing. Optional, defaults to 'https://fwd.metamask.io'. |
forwarderMode | One of the available forwarder modes. Optional, defaults to MetaMaskOnboarding.FORWARDER_MODE.INJECT. |
Instance methods
startOnboarding()
Starts onboarding by opening the MetaMask download page and waiting for MetaMask to be installed. Once the MetaMask extension installation is detected, a message will be sent to MetaMask to register the current site as the onboarding initiator.
stopOnboarding()
Stops onboarding registration, including removing the injected iframe (if any).
Contributing
Setup
- Install Node.js version 12
- If you are using nvm (recommended) running
nvm usewill automatically choose the right node version for you.
- If you are using nvm (recommended) running
- Install Yarn v1
- Run
yarn setupto install dependencies and run any requried post-install scripts- Warning: Do not use the
yarn/yarn installcommand directly. Useyarn setupinstead. The normal install command will skip required post-install scripts, leaving your development environment in an invalid state.
- Warning: Do not use the
Linting
Run yarn lint to run the linter.
Release & Publishing
The project follows the same release process as the other libraries in the MetaMask organization:
- Create a release branch
- For a typical release, this would be based on
main - To update an older maintained major version, base the release branch on the major version branch (e.g.
1.x)
- For a typical release, this would be based on
- Update the changelog
- Update version in package.json file (e.g.
yarn version --minor --no-git-tag-version) - Create a pull request targeting the base branch (e.g.
mainor1.x) - Code review and QA
- Once approved, the PR is squashed & merged
- The commit on the base branch is tagged
- The tag can be published as needed
License
This project is available under the MIT license.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
all changesets reviewed
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/MetaMask/.github/SECURITY.md:1
- Info: Found linked content: github.com/MetaMask/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/MetaMask/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/MetaMask/.github/SECURITY.md:1
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Info: 'branch protection settings apply to administrators' is required to merge on branch 'main'
- Info: 'stale review dismissal' is required to merge on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Info: codeowner review is required on branch 'main'
- Warn: 'last push approval' is disabled on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
9 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/security-code-scanner.yml:13
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/security-code-scanner.yml:14
- Warn: jobLevel 'security-events' permission set to 'write': .github/workflows/security-code-scanner.yml:15
- Warn: no topLevel permission defined: .github/workflows/build-lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/security-code-scanner.yml:1
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-lint.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/MetaMask/metamask-onboarding/build-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-lint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/MetaMask/metamask-onboarding/build-lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build-lint.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/MetaMask/metamask-onboarding/build-lint.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/security-code-scanner.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/MetaMask/metamask-onboarding/security-code-scanner.yml/main?enable=pin
- Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 2 commits out of 30 are checked with a SAST tool
Score
4.6
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More