
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@lightsparkdev/origin
Advanced tools
A design system built on Base UI with direct Figma-to-code styling.
npm install --legacy-peer-deps
npm run dev
src/
├── components/ # React components
│ └── Icon/ # CentralIcon system
├── tokens/ # Generated SCSS variables
└── app/ # Next.js app
tools/
├── base-ui-lint/ # Figma structure validation plugin
└── figma-styles/ # Internal Figma style sync (requires credentials)
tokens/
└── figma/ # Raw Figma token exports
├── origin/ # Origin tokens
└── baseline/ # Baseline tokens
cd tools/base-ui-lint
npm run build
Import in Figma → Plugins → Development → manifest.json
Validates component structure against Base UI's expected anatomy.
import { CentralIcon } from '@/components/Icon';
<CentralIcon name="IconHome" size={24} />
213 vendored icons from Central Icons. Edit scripts/extract-icons.mjs to add icons, then run npm run icons:extract.
Color and spacing tokens are built from exported Figma variables (npm run tokens:build). Typography mixins (_text-styles.scss) and shadow variables (_effects.scss) are generated from an internal Figma file and committed to the repo — external contributors don't need to regenerate them. Don't edit these generated files by hand.
| Command | Description |
|---|---|
npm run dev | Start development server |
npm run build | Production build |
npm run storybook | Start Storybook |
npm run tokens:build | Build tokens from Figma exports |
npm run icons:extract | Vendor icons and regenerate registry |
npm run test | Playwright component tests |
npm run test:unit | Vitest unit tests |
npm run test:all | Run both test suites |
npm run lint | Run ESLint |
Internal maintainers with Figma credentials also have figma:styles and figma:node for syncing styles from the design file.
npm install @lightsparkdev/origin sass
Or for local development:
{ "dependencies": { "@lightsparkdev/origin": "file:../origin" } }
// next.config.ts
import type { NextConfig } from "next";
const nextConfig: NextConfig = {
transpilePackages: ['@lightsparkdev/origin'],
};
export default nextConfig;
import "@lightsparkdev/origin/styles.css";
cp -r node_modules/@lightsparkdev/origin/public/fonts/ public/fonts/
import { Button, Input, Field } from '@lightsparkdev/origin';
If you need Origin mixins in your app SCSS files, configure Sass package imports:
// next.config.ts
import type { NextConfig } from "next";
import * as sass from "sass";
const nextConfig: NextConfig = {
transpilePackages: ['@lightsparkdev/origin'],
sassOptions: {
importers: [new sass.NodePackageImporter()],
},
};
export default nextConfig;
Then use pkg: imports:
@use 'pkg:@lightsparkdev/origin/tokens/text-styles' as *;
For full setup details, see Using Origin in Your App.
Suisse Intl uses font metric overrides for precise line-height control:
@font-face {
font-family: 'Suisse Intl';
ascent-override: 81%;
descent-override: 19%;
line-gap-override: 0%;
}
These values are applied to all weights (Regular, Book, Medium) in _fonts.scss. Consuming apps should import Origin's fonts for correct input rendering. Without the font, the system falls back to system-ui.
docs/using-origin-in-your-app.md — Token/font setup for consuming appsCONTEXT.md — Full project context and history.cursor/rules/ — Auto-injected context for AI assistantsFAQs
Origin Design System v2 - Base UI + Figma-first approach
We found that @lightsparkdev/origin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.