
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@discordapp/twemoji
Advanced tools
A Unicode standard based way to implement emoji across all platforms.
A simple library that provides standard Unicode emoji support across all platforms.
Twemoji v16.0 adheres to the Unicode 16.0 spec and supports the Emoji 16.0 spec. We do not support custom emoji.
The Twemoji library offers support for all Unicode-defined emoji which are recommended for general interchange (RGI).
Run the following inside of your already-initialized project:
npm install @twemoji/api
Default CDN support is provided via jsDelivr.
Use the following in the <head>
tag of your HTML document(s):
<script src="https://cdn.jsdelivr.net/npm/@twemoji/api@latest/dist/twemoji.min.js" crossorigin="anonymous"></script>
This guarantees that you will always use the latest version of the library.
If, instead, you'd like to include the latest version explicitly, you can add the following tag:
<script src="https://cdn.jsdelivr.net/npm/@twemoji/api@16.0.1/dist/twemoji.min.js" integrity="sha384-FXNBc+N64Ez8mfErJZyKRUQcNiNM1eJEuC+BmZF+8NaYNcW5ZkowRlz6y6VdeS8l" crossorigin="anonymous"></script>
If instead you want to download a specific version, please look at the gh-pages
branch, where you will find the built assets for both our latest and older versions.
Following are all the methods exposed in the twemoji
namespace.
This is the main parsing utility and has 3 overloads per parsing type.
Although there are two kinds of parsing supported by this utility, we recommend you use DOM parsing, explained below. Each type of parsing accepts a callback to generate an image source or an options object with parsing info.
The second kind of parsing is string parsing, explained in the legacy documentation here. This is unrecommended because this method does not sanitize the string or otherwise prevent malicious code from being executed; such sanitization is out of scope.
If the first argument to twemoji.parse
is an HTMLElement
, generated image tags will replace emoji that are inside #text
nodes only without compromising surrounding nodes or listeners, and completely avoiding the usage of innerHTML
.
If security is a major concern, this parsing can be considered the safest option but with a slight performance penalty due to DOM operations that are inevitably costly.
var div = document.createElement('div');
div.textContent = 'I \u2764\uFE0F emoji!';
document.body.appendChild(div);
twemoji.parse(document.body);
var img = div.querySelector('img');
// note the div is preserved
img.parentNode === div; // true
img.src; // https://cdn.jsdelivr.net/gh/jdecked/twemoji@latest/assets/72x72/2764.png
img.alt; // \u2764\uFE0F
img.className; // emoji
img.draggable; // false
All other overloads described for string
are available in exactly the same way for DOM parsing.
Here's the list of properties accepted by the optional object that can be passed to the parse
function.
{
callback: Function, // default the common replacer
attributes: Function, // default returns {}
base: string, // default jsDelivr
ext: string, // default ".png"
className: string, // default "emoji"
size: string|number, // default "72x72"
folder: string // in case it's specified
// it replaces .size info, if any
}
The function to invoke in order to generate image src
(s).
By default it is a function like the following one:
function imageSourceGenerator(icon, options) {
return ''.concat(
options.base, // by default jsDelivr
options.size, // by default "72x72" string
'/',
icon, // the found emoji as code point
options.ext // by default ".png"
);
}
The default url is the same as twemoji.base
, so if you modify the former, it will reflect as default for all parsed strings or nodes.
The default image extension is the same as twemoji.ext
which is ".png"
.
If you modify the former, it will reflect as default for all parsed strings or nodes.
The default class
for each generated image is emoji
. It is possible to specify a different one through this property.
The default asset size is the same as twemoji.size
which is "72x72"
.
If you modify the former, it will reflect as default for all parsed strings or nodes.
In case you don't want to specify a size for the image. It is possible to choose a folder, as in the case of SVG emoji.
twemoji.parse(genericNode, {
folder: 'svg',
ext: '.svg'
});
This will generate urls such https://cdn.jsdelivr.net/gh/jdecked/twemoji@latest/assets/svg/2764.svg
instead of using a specific size based image.
Basic utilities / helpers to convert code points to JavaScript surrogates and vice versa.
For a given HEX codepoint, returns UTF-16 surrogate pairs.
twemoji.convert.fromCodePoint('1f1e8');
// "\ud83c\udde8"
For given UTF-16 surrogate pairs, returns the equivalent HEX codepoint.
twemoji.convert.toCodePoint('\ud83c\udde8\ud83c\uddf3');
// "1f1e8-1f1f3"
twemoji.convert.toCodePoint('\ud83c\udde8\ud83c\uddf3', '~');
// "1f1e8~1f1f3"
If you'd like to size the emoji according to the surrounding text, you can add the following CSS to your stylesheet:
img.emoji {
height: 1em;
width: 1em;
margin: 0 .05em 0 .1em;
vertical-align: -0.1em;
}
This will make sure emoji derive their width and height from the font-size
of the text they're shown with. It also adds just a little bit of space before and after each emoji, and pulls them upwards a little bit for better optical alignment.
To properly support emoji, the document character set must be set to UTF-8. This can be done by including the following meta tag in the document <head>
<meta charset="utf-8">
To exclude certain characters from being replaced by twemoji.js, call twemoji.parse() with a callback, returning false for the specific unicode icon. For example:
twemoji.parse(document.body, {
callback: function(icon, options, variant) {
switch ( icon ) {
case 'a9': // © copyright
case 'ae': // ® registered trademark
case '2122': // ™ trademark
return false;
}
return ''.concat(options.base, options.size, '/', icon, options.ext);
}
});
If you're still using our V1 API, you can read our legacy documentation here.
The contributing documentation can be found here.
As an open source project, attribution is critical from a legal, practical and motivational perspective in our opinion. The graphics are licensed under the CC-BY 4.0 which has a pretty good guide on best practices for attribution.
However, we consider the guide a bit onerous and as a project, will accept a mention in a project README or an 'About' section or footer on a website. In mobile applications, a common place would be in the Settings/About section (for example, see the mobile Twitter application Settings->About->Legal section). We would consider a mention in the HTML/JS source sufficient also.
The goal of this project is to simply provide emoji for everyone. We definitely welcome improvements and fixes, but we may not merge every pull request suggested by the community due to the simple nature of the project.
The rules for contributing are available in the CONTRIBUTING.md
file.
Thank you to all of our contributors.
See the LICENSE and LICENSE-GRAPHICS files for full license texts.
Code licensed under the MIT License: http://opensource.org/licenses/MIT
Graphics licensed under CC-BY 4.0: https://creativecommons.org/licenses/by/4.0/
FAQs
A Unicode standard based way to implement emoji across all platforms.
The npm package @discordapp/twemoji receives a total of 19,242 weekly downloads. As such, @discordapp/twemoji popularity was classified as popular.
We found that @discordapp/twemoji demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.