Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@purge-icons/core
Advanced tools
It's now recommended to use [UnoCSS Icons](https://github.com/unocss/unocss/tree/main/packages/preset-icons), [unplugin-icons](https://github.com/antfu/unplugin-icons) or [Iconify Icon Components](https://docs.iconify.design/icon-components/components/) i
It's now recommended to use UnoCSS Icons, unplugin-icons or Iconify Icon Components instead of this approach.
Bundles only the icons you use
Think about TailwindCSS + PurgeCSS, but for Icons.
PurgeIcons is heavily inspired from PurgeCSS. It analyzes your source code or dist files, extracting the icon names you used, and then bundle the icons' data (SVGs) into your code.
You will only get icons you need. No extra bandwidth, no unused icons, no compromise.
Underneath, it's powered by Iconify, which you get access to 80+ popular open source iconsets with over 5,000 icons to choice, including Material Design Icons, Font Awesome, Octicon and even Emojis!
Browser the icon sets in Icônes or Iconify.
Just like what you used to do for Iconify.
<span class="iconify" data-icon="fa:home"></span>
Or even dynamic
const span = createElement('span')
span.class = 'iconify'
span.data.icon = isDark ? 'carbon:moon' : 'carbon:sun'
// DON'T, PurgeIcons won't extract them correct.
// add them to `included` to be always bundled if you really want this
span.data.icon = `carbon:${isDark ? 'moon' : 'sun'}`
PurgeIcons is designed to be framework independent, but using framework plugins is the most recommended way to get started. Check out the supported frameworks in the following list. We are trying to make more frameworks able to use PurgeIcons out-of-box. Pull requests are great welcome!
Plugin | Example | Template | |
---|---|---|---|
Vite | vite-plugin-purge-icons | Example | Vitesse |
Nuxt | nuxt-plugin-purge-module | Example | |
Vue CLI | Coming... | ||
Gridsome | Coming... | ||
Parcel | Coming... | ||
Webpack | purge-icons-webpack-plugin | ||
Rollup | rollup-plugin-purge-icons |
The CLI is still working in progress and the design is not yet finalized.
You can either install PurgeIcons as a dev dependency and use the CLI with npx or you can also install PurgeIcons globally:
npm i -g purge-icons
Scan the all the html file and geneted a mjs
bundle
purge-icons --content 'src/*.html' --format mjs --output output.js
From multiple sources and use args shorthands, format
can be auto inferred from the output
option
purge-icons -c 'index.html,src/**/*.vue' -o output.ts
Or export plain json file for other tools to process
purge-icons -c index.html -o output.json
See more options by
purge-icons --help
Programmatic API is still working in progress as well.
For programmatic use only, you can use @purge-icons/core
npm i -D @purge-icons/core
import { PurgeIconsOptions, PurgeIcons } from '@purge-icons/core'
const code = await PurgeIcons({
// globs for searching source file to analyze
content: [
'**/*.html',
'**/*.js',
'**/*.vue', // scan for .vue file as well
],
// whitelist for icons that might be used dynamically
included: [
'mdi:account-circle-outline', // from Material Design Icons
'fa:camera', // from Font Awesome 4
],
format: 'mjs'
})
// code is generated with inlined icons's data, bundle the file and it's done.
fs.promises.writeFiles('./icons.mjs', code, 'utf-8')
export interface PurgeIconsOptions {
content?: (string | RawContent)[]
included?: string[]
extractors?: Extractor[]
iconSource?: IconSource // default to 'auto'
}
Iconify is an icon framework that provide an unified syntax to use icons from its huge collections on-demanded. Each icon set has a id as the prefix of for its icons. For example:
<span class="iconify" data-icon="fa:home"></span> <!-- Font Awesome -->
<span class="iconify" data-icon="noto:bird"></span> <!-- Note Icons -->
<span class="iconify" data-icon="mdi:alert"></span> <!-- Material Design Icons -->
Iconify achieve that by building up a API service that only send the icons you need. It provides a great flexibility that you can try with different design style and without to worry about including a large amount of unused icons that eat up your bandwidth and slow down your page load.
However, the downside of API querying is that the icons won't be available on the first meaningful paint and your app will be heavy relied on the API servers' status and so its accessability for your users. Iconify also provides the offline solution by implementing frameworks components. In that way, you would need to manually import every icon you use.
Thus, PurgeIcons was born. By scanning your code, it generates bundles for Iconify and load them synchronously. You can use icons in the exact same way as you would with the API based solution.
MIT License © 2020 Anthony Fu
FAQs
It's now recommended to use [UnoCSS Icons](https://github.com/unocss/unocss/tree/main/packages/preset-icons), [unplugin-icons](https://github.com/antfu/unplugin-icons) or [Iconify Icon Components](https://docs.iconify.design/icon-components/components/) i
We found that @purge-icons/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.