
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@polyxd/ds-mono
Advanced tools
Mono template pack for Polyxd (DTCG 2025.10 tokens): an original design to start from and make your own
Mono — an original Polyxd template pack. One hue, many tints: a brand colour ramp in every role (indigo by default); the fastest to rebrand by changing one number.
Every colour role is a tint or shade of one hue, written as oklch(L C 275). The page is the palest tint, text is the darkest shade, borders, selection, the secondary button and the info status are steps between, the six chart colours are six shades of it, and only success, warning and danger step off the hue (green, amber, red at the same lightness recipe). To rebrand, change the hue: replace 275 with your own in tokens/system.light.json and tokens/system.dark.json (one search-and-replace), run polyxd check, and the whole system follows. Everything else — system sans, 8px corners, standard spacing — is deliberately unremarkable so the colour is what you notice.
This is a template: not a reproduction of any design system, and meant to be changed. Start from it, keep what you like, and it stays a valid pack as long as polyxd check passes.
npx polyxd check packages/ds-mono/manifest.json # every contract token, every contrast pair, both modes
Two ways in.
Edit these tokens. Every colour role in tokens/system.light.json and tokens/system.dark.json points at a named entry in that file's palette; change a palette entry and every role using it follows, or point a role at another entry to change one thing. Type, spacing, radii and motion are in tokens/system.json. tokens/semantic.json only aliases those and rarely needs touching. Run polyxd check after each change: it names any pair that no longer meets its contrast floor.
Or start from your own tokens. npx polyxd pack ./your-tokens.css --name yours drafts a pack from a stylesheet or a DTCG file and writes a mapping you correct; this template is then a reference for what each role is for.
Either way, rename it: name in manifest.json is the theme a surface asks for, and [data-pxd-theme="<name>"] is the selector the compiled CSS uses.
| Role | Family | Full stack |
|---|---|---|
display | system-ui | system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif |
body | system-ui | system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif |
label | system-ui | system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif |
mono | ui-monospace | ui-monospace, SFMono-Regular, Menlo, Consolas, 'Liberation Mono', monospace |
Web fonts: None. The pack uses the reader's system fonts, so there is nothing to load.
polyxd check tells you.| File | What it holds |
|---|---|
manifest.json | Name, modes, default mode and provenance |
tokens/system.json | Primitives both modes share: fonts, sizes, spacing, radii, borders, motion |
tokens/system.light.json, tokens/system.dark.json | The palette and the mono.sys.* roles for each mode, plus shadows |
tokens/semantic.json | The Polyxd contract, aliasing mono.* |
Licence Apache-2.0, like the rest of Polyxd. Provenance in the manifest: original template by Polyxd.
logo.svg is Polyxd's own mark for this template, not anyone's logo: a small card drawn only from the template's tokens in its default mode (the ground, strong border and radius, the text and muted text, the primary action and one accent). packages/ds-kit/scripts/pack-logos.ts draws it, so it follows the tokens: change them and run node packages/ds-kit/scripts/pack-logos.ts to redraw it. A test fails if it goes stale.
FAQs
Mono template pack for Polyxd (DTCG 2025.10 tokens): an original design to start from and make your own
The npm package @polyxd/ds-mono receives a total of 16 weekly downloads. As such, @polyxd/ds-mono popularity was classified as not popular.
We found that @polyxd/ds-mono demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.