Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@dollarshaveclub-engineering/ui
Advanced tools
UI is a CSS framework for interfaces commonly built at Dollar Shave Club. Jump to the code here. or dive into the interface.
link
tag.25.6kb
.The artifact of ui
is a CSS file. Place the following code in the head
of your document.
<!-- For including the local development version -->
<link rel="stylesheet" href="/face-assets/ui/local/ui.css">
<!-- For including a particular version -->
<link rel="stylesheet" href="/face-assets/ui/1.0.0/ui.css">
If integrating with face-assets
, you may include that exact URL which will enable automatic integration with every environment, including local.
If you are not integrating with face-assets
, you can include the CSS file in your application however you see fit.
Install UI via NPM
npm i --save-dev git+ssh://git@github.com/dollarshaveclub/ui
You are free to include node_modules/ui/dist/ui.css
in your project however you see fit.
If you wish to import it via SASS, you must first specify the ui
scss src
folder as an includePath
in your sass build configuration
// Your sass build may be different. Reference SASS includePaths for more information
const sassOptions = {
includePaths: [ './node_modules/ui/src/' ],
}
Then you may import variables or mixins via sass
// Import UI Config or Mixins
@import "ui/config/colors"
@import "ui/mixins/breakpoints"
Developing with ui
locally is easy.
nvm use # Ensure you're on the correct version of node
npm i # Install node dependencies
npm run build # Compile CSS and documentation
npm run build-watch # Builds & watch for changes
npm run prepublish # Builds UI react components and places them in dist/components
npm start # Serve documentation page
If you have face-assets
installed in your local dev environment, the build task will copy the CSS files there automatically which will allow you to reference the latest local build file from a simple URL.
In order to use the react components and render them in storybook or consuming react app, you will need to run npm run prepublish
. Prepublish
runs a build task to be able to use it as a dependency in the consuming apps.
Example on how to include the component in your react components:
import BreadcrumbsLarge from 'ui/dist/components/breadcrumbs/large'
Linting is required to merge any branch to master
. They not only dictate any style guides we'd like to adhere to, but help enforce various rules such as nesting depth and use of hex colors.
The linting rules are still a work in progress. Please read the contributing section if you want to add or modify any rules.
apm install linter-stylelint # Install the StyleLint for Atom
npm run lint # Run all linters
npm run eslint # Lint JavaScript
npm run stylelint # Lint SCSS
This process is nearly identical to deploying face-engine
.
package.json
. Also be sure to commit all dist
files!face-assets
, run npm run download-ui
, commit the resulting files, and deploy!How do I use this?
Why does this exist?
Why SCSS?
I am on a different platform than the web and cannot adhere to these standards. What should I do?
BEM is love. BEM is life. Right?
The core difficulties most of us face with CSS are the same things that makes it so powerful; that is largely the cascade. BEM is not meant to be a dogmatic solution to all of our issues. It provides a set of rules that enable us to develop interfaces in equally powerful ways while still managing the cascade.
Not every classname will follow BEM conventions, but that is ok. Most classes tend to do so where applicable. Considerate code review helps thwart oddly specific rules, but also allow strategic advantages in the code.
I want access to the variables and mixins UI provides, not the CSS
ui
with any package manager that supports git or github. Then simply build the src/index.scss
file or build your own scss
file that imports the desired ui
files.Anyone may contribute to ui
as long as the proper checks have been passed. If you're interested in helping with the migration to ui
, anything in the UI - Transition
project is "up for grabs". In favor of authoring code that meets UI standards, consider opening an issue or discussing with any UI counterparts beforehand.
FAQs
DSC Web UI
The npm package @dollarshaveclub-engineering/ui receives a total of 1 weekly downloads. As such, @dollarshaveclub-engineering/ui popularity was classified as not popular.
We found that @dollarshaveclub-engineering/ui demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.