
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@arduino/arc
Advanced tools
This library contains a React-based implementation of the Arduino Component Library.
Storybook is publicly accessible via github pages here
npm i @arduino/arc
Please note that this package has a peer dependecy on react, react-dom and react-aria, you might need to install.
npm i react@^17.0.2 react-dom@^17.0.2 react-aria@3.6.0
This package also offers Arduino color themes, provided in the themes/themes.css file.
Themes are directly pulled from Figma using the Figma API. As reported on the website "The Figma API supports read access and interactions with Figma files. This gives you the ability to view and extract any objects or layers, and their properties."
This data is fetched as a .json file with the following structure:
core contains the colors library which defines the hex value for each color name, e.g.: 'tealscale-teal0': '#7fcbcd'ide-default, ide-dark, ..., are the different themes available, each containing two types of information:
'accent-strong': 'tealscale-teal0''button-primary-bg-hover': 'accent-strong'This file is parsed to generate a ColorLibrary, a list of colors associated with their hex value, and DesignTokens, an object in which each variable is associated with all the available themes and each theme is associated with a color defined in the ColorLibrary.
A workflow has been implemented to pull themes weekly from Figma. It is also possible to do it manually.
Whenever you need to update themes manually, follow these steps:
Get the FIGMA_THEME_FILE_ID from the URL of the Figma file
Generate your FIGMA_API_ACCESS_TOKEN from Figma
Export the environment variables
export FIGMA_API_ACCESS_TOKEN=xxxxxx && export FIGMA_THEME_FILE_ID=xxxxxx
Run the script
npm run update-json-themes
themes/themes.css fileOnce the updated themes are pulled from Figma it's possible to generate the themes/themes.css file using:
npm run build
The generated file will be available in the dist folder. This file will contain a css rule for each theme with internal mapping between all Arduino variables and their values.
An example:
:root .arc-dark {
--arduino-button-primary-bg: #0ca1a6;
--arduino-button-primary-bg-hover: #7fcbcd;
}
Install dependencies with
npm i
Build the project with
npm run build
to test the components locally, run storybook
npm run storybook
to reference a WIP branch from another repo, set the package.json of the other repo to
"dependencies": {
"@arduino/arc": "github:arduino/arc#your-branch",
...
Versioning is automated, and managed via semantic-release
All the commits that lands to main must stick with the Angular Commit Message Conventions (which is CaseSensitive!):
Given the form above in the commits, semantic-release will automatically generate the changelog and bump the version of the libs.
IMPORTANT If you squash merge your commits, only the message in the squashed commit will be read from semantic-release. Please stick to the convention above ☝️ when squash-merging your PRs.
Deployment is handled automatically by the CI when your changes are merged into master. Sit back and relax ☺️
FAQs
Arduino React Components
The npm package @arduino/arc receives a total of 6 weekly downloads. As such, @arduino/arc popularity was classified as not popular.
We found that @arduino/arc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.