Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@kong/design-tokens
Advanced tools
Kong's Design Tokens and Style Dictionary, created with Style Dictionary.
Note: Repository and documentation is a work in progress. This package is currently for Kong internal-use only, but is published publically in order to consume in our OSS projects.
A Style Dictionary is a build system that allows you to define styles once, in a way for any platform or language to consume. A single place to create and edit your styles, and a single command exports these rules to all the places you need them - iOS, Android, CSS, JS, HTML, sketch files, style documentation, or anything you can think of.
TODO.
All design tokens must be placed inside of the /tokens
directory in one of two sub-directories.
Directory | Description |
---|---|
/tokens/alias | The alias directory must only contain alias values that point directly to a raw CSS value. Any tokens defined within the alias directory will not be exposed in the package exports. |
/tokens/source | The source directory contains all tokens that will be available for consumption from the package exports. |
Tokens must be defined in the corresponding JSON files within the /tokens
directory
category
of each token should be its own directory.type
of token should be a file in the category
directory, named {type}.json
type
of token within a category
, you should name the file index.json
Token keys must be lowercase and snake_case
Token keys must be defined in normal alphabetical order
Tokens defined in the /tokens/source/
directory WILL be exported in the build files.
Tokens defined in the /tokens/alias/
directory can be utilized/referenced within the /tokens/source/
files; however, these tokens will NOT be exported in the build files.
Token aliases (e.g. color aliases) must not be exposed/exported from the production build
Tokens at the "root" of their structure must be defined with a key of "_"
to allow for nested child tokens. Example:
{
"color": {
"text": {
"_": {
"comment": "blue-100",
"value": "{color.alias.blue.100}"
},
"neutral": {
"_": {
"comment": "gray-100",
"value": "{color.alias.gray.60}"
},
"strong": {
"comment": "gray-70",
"value": "{color.alias.gray.70}"
}
}
}
}
}
/* Output */
--kui-color-text: #000933;
--kui-color-text-neutral: #6c7489;
--kui-color-text-neutral-strong: #52596e;
To get started, install the package dependencies
yarn install --frozen-lockfile
This repository includes a Vue sandbox (see the /sandbox
directory) to allow you to experiment with consuming tokens.
To start the sandbox:
yarn sandbox
This command will simultaneously start the Vite dev server and initialize a watcher on the /tokens
directory. If any files in the /tokens
directory are modified, the sandbox will automatically run the build command to update the tokens and then restart the Vite dev server (simulating hot module reload).
Updating any files within the sandbox itself will also trigger hot module reload as expected.
Lint package files, and optionally auto-fix detected issues.
# Lint only
yarn lint
# Lint and fix
yarn lint:fix
Utilize the style-dictionary
CLI to build the token assets for production based on the configuration in /config.js
.
yarn build
If additional sub-directories (other than dist/tokens
) are added to the dist/
directory in /config.js
, you will also need to create a new corresponding entry in the package.json > exports
section to allow for importing into the host project without dist/
in the path.
For example, if I want to add a new icons
folder, I'd update the exports
entry as shown here:
"exports": {
"./package.json": "./package.json",
"./tokens/*": "./dist/tokens/*",
"./icons/*": "./dist/icons/*" // New directory
}
git pull origin main
git checkout -b {type}/{jira-ticket}-{description}
- as an example, feat/khcp-1234-add-color-tokens
/tokens
directory as needed, ensuring to adhere to the Token Requirementsyarn lint
to ensure you do not have any linting errors. If you have errors, you can try running yarn lint:fix
to resolveyarn commit
to help build your commit messagegit push origin {branch-name}
This repo uses Conventional Commits.
Commitizen and Commitlint are used to help build and enforce commit messages.
It is highly recommended to use the following command in order to create your commits:
yarn commit
This will trigger the Commitizen interactive prompt for building your commit message.
Lefthook is used to manage Git Hooks within the repo.
commit-msg
hook is automatically setup that enforces commit message stands with commitlint
, see lefthook.yml
pre-push
hook is used that runs eslint
before allowing you to push your changes to the repositoryAdditionally, CI will use commitlint
to validate the commits associated with a PR in the Lint and Validate
job.
This repository utilizes Semantic Release for automated package publishing and version updates.
FAQs
Kong UI Design Tokens and style dictionary
The npm package @kong/design-tokens receives a total of 705 weekly downloads. As such, @kong/design-tokens popularity was classified as not popular.
We found that @kong/design-tokens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.