Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@phosphor-icons/web
Advanced tools
ATTENTION: As part of a major update, we will be replacing the existing
phosphor-icons
package with@phosphor-icons/web
. We recommend using the new version, as it has improved performance and significantly smaller bundle size, in addition to having the option to only load the weights you need. Some class names and APIs have changed, so please read the documentation before upgrading. The legacy package will continue to recieve maintenance, but will not be updated with new icons upstream. Take me to the legacy version ➜
Phosphor is a flexible icon family for interfaces, diagrams, presentations — whatever, really. Explore all our icons at phosphoricons.com.
We use a similar approach as many other icon sets out there, providing icons as several webfonts that uses Unicode's Private Use Area character codes to map normally non-rendering characters to icons. Simply add one or more weights by including its stylesheet to the document <head>
, and drop in icons with an <i>
tag and the appropriate classes for the weight and the icon:
<!DOCTYPE html>
<html>
<head>
<link
rel="stylesheet"
type="text/css"
href="https://unpkg.com/@phosphor-icons/web@2.1.1/src/bold/style.css"
/>
</head>
<body>
<i class="ph-bold ph-smiley"></i>
<i class="ph-bold ph-heart" style="color: hotpink"></i>
<i class="ph-bold ph-cube"></i>
</body>
</html>
Note: You can import as many or as few weights as needed. Only imported weights will match and render as icons.
Phosphor Icons come in 6 weights: regular
, thin
, light
, bold
, fill
, and duotone
. In order to use a weight, you must include a link to its stylesheet, and use the appropriate weight class on the icon (the regular
weight uses .ph
instead of .ph-regular
):
<link
rel="stylesheet"
type="text/css"
href="https://unpkg.com/@phosphor-icons/web@2.1.1/src/duotone/style.css"
/>
...
<i class="ph-duotone ph-baseball"></i>
The URL format is https://unpkg.com/@phosphor-icons/web@<VERSION>/src/<WEIGHT>/style.css
. Other common CDNs may also be used.
If you intend to use all 6 weights, they can be made available by including the library as a script tag, using the base URL:
<script src="https://unpkg.com/@phosphor-icons/web@2.1.1"></script>
...
<i class="ph-light ph-address-book"></i>
<i class="ph ph-sunglasses"></i>
NOTE: Though assets will be cached for subsequent loads, this will bring in around 3MB of fonts and CSS, and may have impact on page load speed.
If your environment supports loading CSS files as modules, icon weights can be imported for effect from the package.
$ yarn add @phosphor-icons/web
import "@phosphor-icons/web/light";
import "@phosphor-icons/web/bold";
Since the icons are just text under the hood, they can be colored and styled with CSS like any other font, including font-size
, color
, etc.
<style>
.ph-bold {
font-size: 48px;
}
.green {
color: limegreen;
}
</style>
...
<!-- 96px -->
<i class="ph-bold ph-airplane"></i>
<!-- 96px and green -->
<i class="ph-bold ph-skull green"></i>
Note: Overriding the
font-family
,font-style
,font-weight
,font-variant
, ortext-transform
may break the icons and render unprintable characters. Don't do it. Additionally, all weights use the:before
pseudoelement to inject the font glyph, so overriding this property in icon classes can break them. Theduotone
weight also uses the:after
pseudoelement, so it is best not to modify either when styling icons.
If you've made a port of Phosphor and you want to see it here, just open a PR here!
MIT © Phosphor Icons
FAQs
A clean and friendly icon family for web
We found that @phosphor-icons/web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.