That headline is quite misleading … the malicious extension only had a few hundred installs, not millions. They just copied an existing extension that does have 7 millions installs. They did went quite far by registering a URL. Of course it is bad that stuff like this manages to get on the store, but as long as you check what you are installing, you should be fine.
This looks really nice, some friends didn’t really like the current design of Lemmy and I think I could convince them to use it through a design like yours. Svelte really is a great tool to quickly get something working. I’m currently rewriting another site in SvelteKit as well.
About CORS / WebSocket. I’m not sure where it will be going with the WebSocket API. The main Lemmy project wants to use the WebSocket API less, as it a high performance impact on instances, and it also often seems to break in the PWA.
I started looking into building a theme for Lemmy, but it was quite difficult to get everything to run well locally. When I did a checkout the main branch had an error in the Rust code and the main branch of the ui had an error that prevented the websocket from connecting to the back-en. I did get it to work by fixing the small error in rust and using a branch that fixed the websocket error. But it was hard to get started.
I was wondering if there is a Lemmy development community here on Lemmy. I tried searching for it on Lemmy.ml, but the cummunties about Lemmy and support don’t really look like they are about development.
Ah it makes more sense that way, I didn’t read the title as if they were talking about all the extensions that they found summed together. This does make it really clear that you should always check extensions when installing them, and not just install extensions with a low install base from an unknown author.