Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@carbon/ibm-products
Advanced tools
Carbon for IBM Products is an open source implementation of the closed source pattern asset library (PAL). These PAL designs build on the foundation of IBM’s open source Carbon Design System and React implementation to offer components and patterns beyond the typical component library. Carbon for IBM Products was previously known as Carbon for IBM Cloud and Cognitive (@carbon/ibm-cloud-cognitive), and this name can still be encountered in various places and historical logs.
Carbon for IBM Products common UI components
If you’re just getting started and looking to browse our React components, take a look at our Storybook.
To use Carbon for IBM Products components, all you need to do is install the
@carbon/ibm-products
package.
$ yarn add @carbon/ibm-products
# or
$ npm install @carbon/ibm-products
Then you can import the component styles in your index.js
.
import '@carbon/ibm-products/css/index.min.css';
Our package requires support for ES modules (see #2378). In Webpack 5, these are supported by default. In Webpack 4, you will need to add the following rule to your config.
rules: [
{
test: /\.mjs$/,
include: /node_modules/,
type: 'javascript/auto',
},
],
@carbon/ibm-products
is built on top of Carbon components and has a number of
dependencies which need to be installed.
carbon-components-react
as per package instructions@carbon/icons-react
as
per package instructions@carbon/elements
as per package instructionsNote: @carbon/elements
rolls up a number of Carbon packages that could be
installed independently. As this list of dependencies could change, we leave you
to view package.json
in ibm-products if you wish to install individual
packages.
Examples for each released component, and some that are still not quite ready, can be found here on
You can find example projects using the components in the examples folder.
To start using the components
import { AboutModal } from '@carbon/ibm-products';
const App = () => {
return <AboutModal />;
};
The @carbon/ibm-products
package uses a default prefix of c4p
for CSS
selectors and some IDs.
Before any @carbon/ibm-products
components are loaded in script or styling
ensure you have done the following.
import { pkg } from '@carbon/ibm-products/es/settings';
pkg.prefix = 'tst';
When using multiple components from the library:
@use '@carbon/ibm-products/scss' with (
$pkg-prefix: 'tst'
);
When using individual components e.g. AboutModal:
@use '@carbon/ibm-products/scss/config' with (
$pkg-prefix: 'tst'
);
@use '@carbon/ibm-products/scss/components/AboutModal';
See the example gallery for the most up-to-date prefix examples.
Components that have not yet completed the release review process are considered
to be canary and require the consumer to enable via a feature flag in a
config.js
file.
For example, create a config.js
in your src
directory:
import { pkg } from '@carbon/ibm-products';
// Enable 'canary' (not yet reviewed/released) components
// that we want to make use of
pkg.component.AboutModal = true;
pkg.component.SidePanel = true;
// Live dangerously: enable all components!
pkg.setAllComponents(true);
// Enable a feature flagged examples
pkg.feature.nameOfFeature = true;
pkg.feature['Component.feature'] = true;
// Live dangerously: enable all pre-release features!
pkg.setAllFeatures(true);
The default values for component and feature flag settings can be found by running the following command.
node node_modules/@carbon/ibm-products/flags.js
Note: The above settings must happen before a component first renders or a feature is first used.
Note: 2 In the case of features implemented via hooks the feature may function without enabling. In all cases features that disabled by default will log in the console a warning if enabled via a feature flag or an error if not.
To get started, run the following commands and Storybook will be built and then
served on port 3000
on your local machine.
yarn install
yarn storybook
To build all the packages, run the following command.
yarn build
This library supports the latest versions of:
This project is made possible by several community members who have invested their precious time to give back to the Carbon community. It will continue to be possible by having those that benefit from the package contribute back to it.
So, do not be shy. We both depend on and appreciate contributors, new and old, who help us fix bugs, build new features, improve our documentation, etc.
If you’re interested, definitely check out our Contributing Guide and Carbon’s Developer Handbook! 👀
Lee Chase 💻 | David Menendez 💻 | Matthew Gallo 💻 |
Simon Finney 💻 | Polina Olemskaia 💻 |
This package uses IBM Telemetry to collect de-identified and anonymized metrics data. By installing this package as a dependency you are agreeing to telemetry collection. To opt out, see Opting out of IBM Telemetry data collection. For more information on the data being collected, please see the IBM Telemetry documentation.
Licensed under the Apache-2.0 License.
FAQs
Carbon for IBM Products
We found that @carbon/ibm-products demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.