
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@hyphen/hyphen-design-tokens
Advanced tools
A central location to store shared attributes of the hyphen Design System. These attributes include: colors, fonts, spacing, and more. Using Amazon's Style Dictionary we transform attributes into usable variables for a variety of platforms.
pnpm add @hyphen/hyphen-design-tokens
Ideally you'd want to import them into a file that exposes them to your entire application.
CSS Variables imported into a .css file
@import "~@hyphen/hyphen-design-tokens/build/css/variables.css";
SASS Variables imported into a .scss file
@import "~@hyphen/hyphen-design-tokens/build/scss/variables.scss";
CSS Utility Classes imported into a .css file
@import "~@hyphen/hyphen-design-tokens/build/utilities/utilities.css";
CSS
.class-with-base-text-color: {
color: var(--color-font-base);
}
--my-own-shadow-variable: 1rem 1rem var(--color-base-black);
The library includes custom svg icons from the design system. They are provided in two formats, svg or as React components.
They can be pulled from the build here:
@hyphen/hyphen-design-tokens/build/assets/icons/ // <-- SVG ICONS
@hyphen/hyphen-design-tokens/build/assets/icons/react // <-- React Components. NOTE: there is an index file that maps all icons in a dictionary, but they can also be used individually.
USING RAW SVGs
<img src="../user.svg" alt="user" />
USING REACT COMPONENTS
import UserIcon from '@hyphen/hyphen-design-tokens/build/assets/icons/react/Add'; <-- Single Icon Import
// or
import icons from '@hyphen/hyphen-design-tokens/build/assets/icons/react; <-- Icon map
const MyUserIcon = icons['user']; <-- Use icon name to.
<MyUserIcon {...props} />
// All icon names are documented in the IconName union type.
import { IconName } from '@hyphen/hyphen-design-tokens/build/types';
To build tokens locally run pnpm run build. NOTE: you will need a local .env file with a Figma access token assigned to FIGMA_PERSONAL_ACCESS_TOKEN. See HOW TO GET A FIGMA ACCESS TOKEN. If you are still unsure how to get a working access token, or the process is not working for you, please reach out to one of our library owners.
In order to test any local changes you'll need to build tokens, and symlink your local package into any project that consumes it. See pnpm link, npm link or yarn link for more details.
The build process handles the following:
/icons folder into the appropriate build directoryIconName type based on the file names in the directory.As a developer, to update icons all that needs to be done is add them to the /icons folder with the name that you want the icon to have. Please follow
these rules when exporting and adding icons:
1em so they will inherit their size from the adjacent element font sizes, or a class/style applied directly.'currentColor' for both these attributes. This will ensure proper inheritance.classNames or title that might be in the svg filekebab-case.hyphen Components uses the semantic-release npm package to fully automate the release workflow. Instead of manually updating the release version in package.json, and creating a new release tag in GitHub for each release, they are automatically triggered by prefixing the commit message when merging to main. Upon triggering a release, the package version is bumped depending on the type specified, a release tag is created in GitHub, and the new version is automatically published to npm.
For example, opening a PR to main with the commit message fix: Resolve bug, will trigger a minor release and bump the package's version from 0.0.0 to 0.0.1. Opening a PR with feat(Table): Finalize tests will trigger a feature release and bump the package's version from 0.0.0 to 0.1.0.
The link above provides full documentation for this workflow. However, a comprehensive list of the prefix types, and their intended uses are provide below for quick reference:
Must be one of the following:
If your code includes major changes or any breaking changes to the codebase, I.E, a new major version, or a large refactor, that will require a pre-release,
and more extensive testing. To publish a pre-release, open (and eventually merge) your PR against the beta branch. This will
publish the package with a @beta tag which can then be easily consumed and tested by other consumers locally.
Publishing to NPM is handled automatically by the CI/CD pipeline. Here are the steps:
package.json to the appropriate type, and merge your PR to main.release in github with the appropriate version number. This will trigger the CI/CD pipeline to publish the package to NPM.If you need to publish a pre-release, or a hotfix, you can do so manually by following these steps:
main branchpnpm run build to ensure the package is up to datepnpm version [major | minor | patch | prerelease] to bump the package versionpnpm publish --tag <insert tag> to publish the package to NPMFAQs
Design tokens that power all Hyphen UIs.
The npm package @hyphen/hyphen-design-tokens receives a total of 110 weekly downloads. As such, @hyphen/hyphen-design-tokens popularity was classified as not popular.
We found that @hyphen/hyphen-design-tokens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.