
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@onfido/castor-react
Advanced tools
Castor React is Onfido's design system addition. It provides React component library.
npm install @onfido/castor @onfido/castor-react
Follow Castor instructions for initial setup.
If you plan to use Icon component, also install Castor Icons package:
npm install @onfido/castor-icons
Then (only once) inline the SVG sprite in your app:
import { Icons } from '@onfido/castor-icons';
import React, { Fragment } from 'react';
const App = () => (
<Fragment>
<Icons />
{/* ...anything else e.g. app routes */}
</Fragment>
);
Include any Castor component and use it within JSX directly.
import { Button } from '@onfido/castor-react';
Then use within your JSX app. For example, as a "destructive" kind:
import React, { Fragment } from 'react';
const App = () => (
<Fragment>
<Button kind="destructive">Destructive Button</Button>
</Fragment>
);
Please note that Castor is exported as an ECMAScript module targeting ECMAScript 2019.
You may wish to configure your bundler to transpile to a different module syntax, and/or to target a lower ECMAScript version.
For example, you might choose UMD module syntax targeting ES5 if your app needs to support IE11 (please note that Castor is not tested in Internet Explorer).
Components extend base prop types with JSX additions.
When using with TypeScript, always import types from @onfido/castor-react
.
Please note that the @onfido/castor-icons
package is a peer dependency and is required to be installed for types to work properly. Yarn and newer versions of npm (using lockfile v2) will resolve it, otherwise it must be installed manually even if you don't plan to use icons.
You should use props for each component modifier, but it is also possible to create custom styled components.
For example, if you'd like a round button, you could create a component using "full" border-radius token:
import styled from '@emotion/styled';
import { borderRadius } from '@onfido/castor';
import { Button } from '@onfido/castor-react';
const RoundButton = styled(Button)({
borderRadius: borderRadius('full'),
});
If you need to prototype with Castor, the quickest way is to use the generated single file global Castor
exposed as IIFE module:
<script src="https://cdn.jsdelivr.net/npm/@onfido/castor-react/prototype.min.js"></script>
You can also use any previously released version (v1.2.0 and up), for example:
<script src="https://cdn.jsdelivr.net/npm/@onfido/castor-react@1.2.0/prototype.min.js"></script>
The same prototype file (not minified) is located on each npm package version.
For modern browsers you may use ECMAScript modules directly via Skypack:
<script type="module">
import { borderRadius } from 'https://cdn.skypack.dev/@onfido/castor';
import { Button } from 'https://cdn.skypack.dev/@onfido/castor-react';
// all other app code
</script>
Also it is easy to use Skypack distributions with Deno.
FAQs
React component library for Castor.
We found that @onfido/castor-react demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.