
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@homebound/beam
Advanced tools
[](https://www.npmjs.com/package/@homebound/beam)
Homebound's React component design system.
To see the latest designs, check out the Figma file.
# Only when running for the first time to install dependencies for Beam & Truss
> yarn
> cd ./truss && npm i # Note that this will change director to /truss
# Easiest way to start. This runs Storybook.
> yarn start
# Re-build src/Css.ts after changing truss/ config files
> yarn build:truss
# Automatically re-build src/Css.ts after changing truss/ config files
> yarn watch:truss
tldr: Consistency & Brevity over Power & Flexibility.
Beam is "Homebound's Design System". Given this extremely narrow purpose, we can lean into the simplicity of:
The most concrete manifestation of this is that we want to provide as few props as possible.
Fewer props generally means:
All of these points are generally in stark contrast to traditional, "big" UI toolkits like Material UI, Carbon from IBM, Spectrum from Adobe, etc., where they have to be "everything for everyone", and have the large API surface areas and complexity that comes with it.
For them, a MUI application in Company A shouldn't have to look & behave exactly like a MUI application in Company B. Which makes sense.
But for Beam at Homebound, we specifically want a component that behaves in our App A to look & behave the same as it does in our App B.
When designers have new Figmas, or give UX feedback, that would require adding new stylistic props to Beam components (i.e. props to change color, size, layout, etc), we should:
Let them know their change doesn't match the existing Beam style, and confirm they really meant for this to be a non-standard change (discouraged).
Ask them if they want this change to be rolled out app-wide, which would be fine & means we can avoid adding the per-page props (preferred).
If they insist this is both a necessary change, but not app-wide, can we describe this ask as a "variant" or "style" or other "high-level knob", that is not making pages pick individual, low-level pixels and color values (fine now & then).
As we open source Beam, this vision of "as few props as possible", "components must look the same in every app" doesn't seem like something that other companies/projects would adopt (i.e. surely they want different colors, slightly different behavior to suit their user base, etc.).
Our proposal for solving this tension is to adopt a radically different model than "pull in the Beam npm library into your app and just use it as-is" (although you're free to do that too): it's forking.
"Adopters" of Beam should of course contribute back bug fixes and feature improvements; but they should also feel free (and encouraged) to run their own company-specific forks, and "customize by changing the source".
In this way, Beam should be seen as a place to "copy & paste" start from, rather than a project that will have 1,000s of npm downloads, and 100s of companies all collaborating on getting this one TextField implementation to behave in the 101 different ways that they each want.
Beam follows semantic releases.
If you want to make an alpha release, just create/push to the alpha branch.
You don't need to create a PR for the alpha branch.
FAQs
[](https://www.npmjs.com/package/@homebound/beam)
The npm package @homebound/beam receives a total of 1,646 weekly downloads. As such, @homebound/beam popularity was classified as popular.
We found that @homebound/beam demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 25 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.