
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@clovirtualfashion/components
Advanced tools
node: ^22.14.0
yarn: ^4.9.1
vite: ^6.3.5
react: ^19.1.0
tailwindcss: ^3.4.17
typescript: ~5.7.2
tailwind-variants: ^1.0.0
tailwindμ classNameμ μ‘°ν©νμ¬ μ¬μ©ν μ μκ² ν΄μ£Όλ λΌμ΄λΈλ¬λ¦¬. μ μ¬ν λΌμ΄λΈλ¬λ¦¬λ‘λ cva(class-variance-authority), twin λ±μ΄ μκ³ , μ¬μ©μ νΈμμ±κ³Ό variantμ λ°λΌ λ€λ₯Έ μ€νμΌ μ μ©μ΄ λλ Compound variants κ·Έλ¦¬κ³ ν΄λμ€ μΆ©λ ν΄κ²° λ± λ€μν κΈ°λ₯λ€μ μ₯μ μΌλ‘ μ ν.
π€ μμ§ μ΄κΈ°μ΄λ tailwind-variantsμ λΉκ΅ κ³ λ―Ό νλ cva + tailwind-merge μ λν΄μλ ν보ꡰμΌλ‘ κ³ λ―Όν΄λ΄λ μ’μ κ² κ°μ΅λλ€.
src/
βββ components/ # μ»΄ν¬λνΈ λλ ν 리
β βββ button/ # λ²νΌ μ»΄ν¬λνΈ
β β βββ src
β β β βββ Button.styles.ts # λ²νΌ μ€νμΌ
β β β βββ Button.types.ts # λ²νΌ νμ
μ μ
β β β βββ Button.tsx # λ²νΌ μ»΄ν¬λνΈ κ΅¬ν
β β βββ index.ts # λ²νΌ μ»΄ν¬λνΈ λ΄λ³΄λ΄κΈ°
β β
β βββ {componentName}/ # {componentName} μ»΄ν¬λνΈ
β β βββ src
β β β βββ {componentName}.styles.ts # Component μ€νμΌ
β β β βββ {componentName}.types.ts # Component νμ
β β β βββ {componentName}.tsx # Component ꡬν
β β βββ index.ts # {componentName} κ΄λ ¨ νμΌλ€
β βββ index.ts # μ 체 μ»΄ν¬λνΈ λ΄λ³΄λ΄κΈ°
β
βββ styles/ # μ€νμΌ κ΄λ ¨ νμΌ
β βββ global.css # μ μ μ€νμΌ (tailwindcss)
β
βββ vite-env.d.ts # Vite νκ²½ μ μ νμΌ
βββ vite.config.ts # Vite μ€μ νμΌ
βββ tailwind.config.ts # tailwindcss μ€μ νμΌ
βββ index.ts # λΌμ΄λΈλ¬λ¦¬ μ§μ
μ
μ€μ: Tailwindcss 4λΆν° λ³κ²½λ μ¬νμΌλ‘, λΉλ κ³Όμ μμ μ¬μ©νμ§ μλ classNameμ μλμΌλ‘ μ κ±°λ©λλ€.
νΉμ ν΄λμ€κ° μ κ±°λμ§ μκ³ μ μ§λλλ‘ νλ €λ©΄ λ°λμ
safelist-tailwind.txtνμΌμ λͺ μν΄μΌ ν©λλ€.
ν¨ν΄ νμ(μ:
bg-*)μ νμ©λμ§ μμΌλ©°, κ° ν΄λμ€λ₯Ό κ°λ³μ μΌλ‘ λͺ μν΄μΌ ν©λλ€.
## Aurora root
yarn @components build
# or
# Aurora Component packages
yarn build
## Aurora root
yarn @components component:create
# or
# Aurora Component packages
yarn component:create
## Aurora root
yarn @components validate:components
# or
# Aurora Component packages
yarn validate:components
/*
* Import design system styles
* μ»΄ν¬λνΈ μ¬μ© μ λ°λμ μ€νμΌμ λ¨Όμ import ν΄μΌ ν©λλ€.
*/
import "@clovirtualfashion/components/styles";
// μ»΄ν¬λνΈ κ°μ Έμ€κΈ°
// case 1
import Button from '@clovirtualfashion/components/button'
// case 2
import { Button } from "@clovirtualfashion/components"
// μ¬μ© μμ
<Button label="λ²νΌ ν
μ€νΈ" />
μ»΄ν¬λνΈλ μ ννλ ꡬ쑰λ₯Ό μ μ§ν΄μΌ ν©λλ€. λ€μ λͺ λ Ήμ΄λ₯Ό μ¬μ©νμ¬ λͺ¨λ μ»΄ν¬λνΈμ ꡬ쑰λ₯Ό κ²μ¬ν μ μμ΅λλ€:
yarn check:structure
μ¬λ°λ₯Έ ꡬ쑰λ λ€μκ³Ό κ°μ΅λλ€:
src/components/
βββ {componentName}/ # {componentName} μ»΄ν¬λνΈ (μλ¬Έμ)
βββ index.ts # μ»΄ν¬λνΈ μ§μ
μ
βββ src/
βββ {ComponentName}.tsx # μ»΄ν¬λνΈ κ΅¬ν (λλ¬Έμ μμ)
βββ {ComponentName}.styles.ts # μ»΄ν¬λνΈ μ€νμΌ
βββ {ComponentName}.types.ts # μ»΄ν¬λνΈ νμ
FAQs
Unknown package
We found that @clovirtualfashion/components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authoritiesβ publishing activity, highlighting trends and transparency across the CVE ecosystem.