
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@iconify/tools
Advanced tools
This library is a collection of tools for importing, exporting and processing SVG images.
Its main purpose is to convert icon sets and fonts to Iconify JSON collections, but it can be used for other purposes.
First install it by running this command:
npm install @iconify/tools --save
The following code example does the following:
currentColor.IconifyJSON icon set.import { promises as fs } from 'fs';
import { importDirectory } from '@iconify/tools/lib/import/directory';
import { cleanupSVG } from '@iconify/tools/lib/svg/cleanup';
import { runSVGO } from '@iconify/tools/lib/optimise/svgo';
import { parseColors, isEmptyColor } from '@iconify/tools/lib/colors/parse';
(async () => {
// Import icons
const iconSet = await importDirectory('svg/test', {
prefix: 'test',
});
// Validate, clean up, fix palette and optimise
await iconSet.forEach(async (name, type) => {
if (type !== 'icon') {
return;
}
const svg = iconSet.toSVG(name);
if (!svg) {
// Invalid icon
iconSet.remove(name);
return;
}
// Clean up and optimise icons
try {
cleanupSVG(svg);
await parseColors(svg, {
defaultColor: 'currentColor',
callback: (attr, colorStr, color) => {
return !color || isEmptyColor(color)
? colorStr
: 'currentColor';
},
});
runSVGO(svg);
} catch (err) {
// Invalid icon
console.error(`Error parsing ${name}:`, err);
iconSet.remove(name);
return;
}
// Update icon
iconSet.fromSVG(name, svg);
});
// Export as IconifyJSON
const exported = JSON.stringify(iconSet.export(), null, '\t') + '\n';
// Save to file
await fs.writeFile(`output/${iconSet.prefix}.json`, exported, 'utf8');
})();
Full documentation is too big for simple README file. See Iconify Tools documentation for detailed documentation with code samples.
Most functions in example above are asynchronous.
If you need to import or parse icons synchronously, such as in config file of package that does not support async configuration files, most functions have synchronous copies, such as importDirectorySync().
Library is released with MIT license.
© 2021-PRESENT Vjacheslav Trushkin
FAQs
Collection of functions for cleaning up and parsing SVG for Iconify project
The npm package @iconify/tools receives a total of 90,272 weekly downloads. As such, @iconify/tools popularity was classified as popular.
We found that @iconify/tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.