Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@rhds/tokens
Advanced tools
Design Tokens for Red Hat's Digital Design System.
npm i @rhds/tokens
We use style-dictionary to transform our tokens into multiple formats and helpers.
Apply defaults to the document root by importing the global stylesheet:
<link rel="stylesheet" href="/url/to/@rhds/tokens/css/global.css">
<style>
:is(h1, h2, h3, h4, h5, h6) {
font-family: var(--rh-font-family-heading);
}
</style>
Reset a component's styles (preventing inheritance) by adding resetStyles
to it's static Constructible Style Sheet list:
import { resetStyles } from '@rhds/tokens/css/reset.css.js';
import style from './rh-jazz-hands.css';
@customElement('rh-jazz-hands')
export class RhJazzHands extends LitElement {
static readonly styles = [resetStyles, style];
}
Import tokens as JavaScript objects:
import { tokens } from '@rhds/tokens';
html`<span style="color: ${tokens.get('--rh-color-blue-300')}">I'm blue</span>`;
or for tree-shakable imports:
import { ColorBlue300 } from '@rhds/tokens/values.js';
html`<span style="color: ${ColorBlue300}">I'm blue</span>`;
:warning: NOTE
We strongly recommend using CSS variables (and accompanying snippets) wherever, instead of importing tokens as JavaScript objects.
Install the stylelint plugin to automatically correct token values in your files.
See the Stylelint Plugin README for more info.
The experimental 11ty plugin lets you display token values in an 11ty site.
Editor snippets complete prefixes like --rh-color-brand
to their CSS custom properties, complete with fallback, e.g.
color: var(--rh-color-brand, #ee0000);
They also provide reverse lookup, so if you want to choose between all the tokens with value #e00
, you can do so by completing the prefix e00
.
Load snippets in VSCode:
Download the VSIX bundle from the releases page.
Or, search the VSCode marketplace for Red Hat Design Tokens
Load snippets in neovim via LuaSnip:
require 'luasnip.loaders.from_vscode'.lazy_load { paths = {
-- Path to the built project, perhaps in your `node_modules`
'~/Developer/redhat-ux/red-hat-design-tokens/editor/vscode'
} }
vim-hexokinase
Vim users can load the vim-hexokinase plugin to display colour swatches
next to their encoded values in their editor. Use the following config (lua syntax, for neovim users) to configure
hexokinase to display colour values next to colour aliases like {color.brand.red}
vim.g.Hexokinase_optInPatterns = {
'full_hex', 'triple_hex',
'rgb', 'rgba',
'hsl', 'hsla',
'colour_names',
}
vim.g.Hexokinase_ftOptOutPatterns = {
json = { 'colour_names' },
yaml = { 'colour_names' },
}
vim.g.Hexokinase_palettes = {
-- replace with path to the built tokens package on your drive
vim.fn.expand'~/Developer/redhat-ux/red-hat-design-tokens/editor/neovim/hexokinase.json'
}
See CONTRIBUTING.md
FAQs
Red Hat Design System Tokens
The npm package @rhds/tokens receives a total of 613 weekly downloads. As such, @rhds/tokens popularity was classified as not popular.
We found that @rhds/tokens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.