
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@kjanat/svg-toolkit
Advanced tools
All svg-toolkit CLIs in one install: svg-language-server (svg-ls), svg-lint, and svg-format.
Every svg-toolkit CLI in one install:
npm install -g @kjanat/svg-toolkit
puts svg-language-server (alias svg-ls), svg-lint, and svg-format on
your PATH, via exact-pinned dependencies on the individual packages.
svg-toolkit?Because npm. The unscoped name svg-toolkit has been squatted since 2019 by an
abandoned "base 3d" package, and npm's name police block anything that even
smells like an existing name — which is also why there is no unscoped svg-lint
(npm considers it "too similar" to svglint; fucking great, thanks npm). So:
scoped it is.
| Tool | Unscoped alias | Canonical |
|---|---|---|
| LSP server | svg-language-server | @svg-toolkit/svg-language-server |
| Linter | — (blocked by npm) | @svg-toolkit/svg-lint |
| Formatter | svg-format | @svg-toolkit/svg-format |
Each resolves a prebuilt native binary for your platform via
optionalDependencies on @svg-toolkit/* platform packages — no postinstall
step, no install-time network access outside npm.
FAQs
All svg-toolkit CLIs in one install: svg-language-server (svg-ls), svg-lint, and svg-format.
The npm package @kjanat/svg-toolkit receives a total of 49 weekly downloads. As such, @kjanat/svg-toolkit popularity was classified as not popular.
We found that @kjanat/svg-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.