
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@glyphicjs/core
Advanced tools
Layout and rendering engine for Glyphic — typed JSON in, deterministic SVG & PNG out, no headless browser. Built for LLMs and agents.
The rendering engine for Glyphic. Takes a validated diagram (JSON) and returns SVG, a high-resolution PNG, and React Flow JSON — with no headless browser.
npm install @glyphicjs/core @glyphicjs/schema
import { processDiagram } from "@glyphicjs/core";
import { writeFileSync } from "node:fs";
const result = await processDiagram({
type: "flowchart",
title: "Login flow",
direction: "TB",
nodes: [
{ id: "start", label: "Visit /login", shape: "rounded" },
{ id: "auth", label: "Valid credentials?", shape: "diamond" },
{ id: "ok", label: "Dashboard", shape: "rectangle" },
{ id: "err", label: "Show error", shape: "rectangle", metadata: { color: "#ef4444" } }
],
edges: [
{ source: "start", target: "auth" },
{ source: "auth", target: "ok", label: "yes" },
{ source: "auth", target: "err", label: "no" }
]
});
writeFileSync("login.png", result.png);
writeFileSync("login.svg", result.svg);
processDiagram(input, fontBuffer?)function processDiagram(
input: unknown,
fontBuffer?: ArrayBuffer
): Promise<RenderResult>;
input — any value; it is validated with @glyphicjs/schema's DiagramInput and throws a ZodError if invalid. (You can pass an already-parsed object or raw JSON.)fontBuffer (optional) — a .ttf/.otf buffer embedded into the PNG so a custom font appears in the raster (resvg cannot fetch remote font URLs at rasterization time).interface RenderResult {
svg: string; // scalable vector markup (role="img" + <title>)
png: Buffer; // high-resolution PNG (2× by default)
metadata: { width: number; height: number };
reactFlow?: ReactFlowConfig; // node/edge & flow diagrams only
}
svgandpngare always produced.reactFlowis included for graph/flow diagrams (not forpie,quadrant, orcanvas).
input ──▶ validate (@glyphicjs/schema)
──▶ layout (registry → elkjs / d3 / custom adapter)
──▶ scene graph (shapes, labels, edges, markers)
──▶ SVG (escaped + sanitized output)
──▶ PNG (@resvg/resvg-js, native)
Each diagram type is wired in src/registry.ts, which maps a type to its layout adapter and render strategy — the single place to extend. See CONTRIBUTING.
Pass a theme (preset string or object), a fontFamily / customFontUrl, and FontAwesome icons or customIcons directly in the diagram JSON. See the theming guide.
SVG output is escaped, and any custom SVG you provide (via customIcons or a
canvas node's raw-svg content) is run through a regex-based sanitizer that
strips <script> tags, event-handler attributes, and <foreignObject>. This
is defense-in-depth, not a guarantee — regex sanitization can't catch every
malformed-markup edge case. If you render the returned svg as live DOM in a
browser from untrusted input, sanitize it yourself with a proper HTML/SVG
sanitizer such as DOMPurify before
insertion. PNG output is unaffected, since it's rasterized bytes, not markup.
elkjs (graph layout), d3-hierarchy / d3-sankey / d3-shape (data layouts), @resvg/resvg-js (rasterization), and @fortawesome/* (icons).
FSL-1.1-ALv2 (Functional Source License) — converts to Apache-2.0 two years after each version's release.
FAQs
Layout and rendering engine for Glyphic — typed JSON in, deterministic SVG & PNG out, no headless browser. Built for LLMs and agents.
The npm package @glyphicjs/core receives a total of 1 weekly downloads. As such, @glyphicjs/core popularity was classified as not popular.
We found that @glyphicjs/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.