
Research
/Security News
npm Author Qix Compromised via Phishing Email in Major Supply Chain Attack
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
@intouchg/catalog
Advanced tools
CLI and Storybook for exploring and downloading React components
CLI and Storybook for exploring and downloading React components
The CLI allows downloading the source code of any component package in this monorepo. Every component package is expected to have a Storybook story file - so devs can browse the components in Storybook and use the CLI to download the source code in either TypeScript and JavaScript.
npx @intouchg/catalog@latest PATH -c COMPONENT_NAME -b BRANCH_NAME -t
All arguments are optional. If a component name is not passed to the CLI then a searchable list of components will be presented to the user.
PATH
is the directory path that the component will be downloaded into, and defaults to process.cwd()
-c COMPONENT_NAME
or --component COMPONENT_NAME
is the name of the component to download. If left empty, the user will select from a searchable list-b BRANCH_NAME
or --branch BRANCH_NAME
is the git branch to download from, defaults to master
-t
or --typescript
will download TypeScript component source code instead of JavaScriptBuilding complex components that can address every use case while still providing an elegant developer experience is nearly impossible. Even when done well, bundle sizes are bloated and the developer must learn the API of each complex component. This project takes the approach of providing source code "recipes" that are intended to be downloaded and customized as needed.
Although this project is structured as a Lerna monorepo, individual component packages are not published to npm at this time. Package source code is intended to be downloaded, not imported. Because they are not installed through npm, it's possible for updates to be made to a package without updating its version number. This could be fixed by using npm as the package download mechanism, or adding a pre-commit build step.
All packages are built in TypeScript and transpiled while preserving JSX, which allows the developer to download either TypeScript or JavaScript source code.
packages
directorypackage.json
file with a name
, version
, and description
package.json
name
field must be the same as the name of the package directorypeerDependencies
listed in the repo root package.json
filepeerDependencies
and devDepdendencies
in their individual package.json
filesdependencies
in their package.json
filesbuild.js
scriptThe build script gathers metadata about all packages in the monorepo. This metadata is used by the CLI - so updated metadata should always be pushed to the git repo alongside any package changes.
FAQs
CLI and Storybook for exploring and downloading React components
We found that @intouchg/catalog demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.