
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@sage/design-tokens
Advanced tools
This repository contains the design tokens from the Sage Design System. These are maintained by the Sage DS team. This library is for distributing these tokens across multiple platforms.
Design Tokens are Design System’s most basic, lowest level element. In atomic design terminology those would be the protons or electrons.
Basically those are key-value records named and organized the same way regardless of the platform (e.g. web, Android, iOS, Figma). They can define various properties, such as colors, paddings, margins, sizes, font sizes, font families, transitions, animations, and others. They represent certain design decisions.
Design tokens purpose is to:
To make use of these tokens in your application, import the correct variable definitions based on your styling technology.
To add to a project using npm:
# If you're using npm:
npm install --save @sage/design-tokens
# OR If you're using yarn:
yarn add @sage/design-tokens
You can also add the files directly by downloading from the releases page on Github.
To make use of the css variables, import them into your code like so:
@import url("@sage/design-tokens/css/light.css");
@import url("@sage/design-tokens/css/dark.css") (prefers-color-scheme: dark);
@import url("@sage/design-tokens/css/components/button.css");
Note: For manual theme switching in JavaScript applications, we recommend using the HTML <link> approach rather than dynamic imports to avoid bundler complexity. You can import the component css files in your JS like below.
import "@sage/design-tokens/css/components/button.css";
<link rel="stylesheet" href="node_modules/@sage/design-tokens/css/light.css" id="app-theme">
<script type="text/javascript">
function switchTheme(theme) {
document.getElementById('app-theme').href =
`node_modules/@sage/design-tokens/css/${theme}.css`;
}
function updateTheme() {
const prefersDark = window.matchMedia("(prefers-color-scheme: dark)").matches;
switchTheme(prefersDark ? "dark" : "light");
}
// Listen for system preference changes
window.matchMedia("(prefers-color-scheme: dark)")
.addEventListener("change", updateTheme);
// Set initial theme on content load
document.addEventListener("DOMContentLoaded", updateTheme);
</script>
The SCSS format provides traditional Sass variables while handling mode switching through separate mode files. Due to variable naming conventions, loading both light and dark modes simultaneously would cause conflicts. To address this, dedicated mode files are provided.
button.scss, container.scss) - Available for granular importsglobal, light and dark tokens are also exported in their own files for granularity as wellNote: The current SCSS output requires the use of @import statements to ensure variables are properly scoped across files. While @import will be deprecated when Dart Sass 3.0.0 is released, we will endeavor to update our output format to support the modern @use module system before that release.
To suppress deprecation warnings during compilation, add the --silence-deprecation=import flag to your Sass build command.
Import specific components when you only need certain tokens and create separate CSS files for each mode:
// button-light.scss
@import "@sage/design-tokens/scss/global.scss";
@import "@sage/design-tokens/scss/light.scss";
@import "@sage/design-tokens/scss/components/button.scss";
.button-destructive-primary {
background-color: $button-destructive-primary-bg-default;
&:hover {
background-color: $button-destructive-primary-bg-hover;
}
}
// button-dark.scss
@import "@sage/design-tokens/scss/global.scss";
@import "@sage/design-tokens/scss/dark.scss";
@import "@sage/design-tokens/scss/components/button.scss";
.button-destructive-primary {
background-color: $button-destructive-primary-bg-default;
&:hover {
background-color: $button-destructive-primary-bg-hover;
}
}
Build process:
sass button-light.scss:button-light.css --no-source-map --silence-deprecation=import
sass button-dark.scss:button-dark.css --no-source-map --silence-deprecation=import
const commonTokens = require("@sage/design-tokens/js/common");
const buttonTokens = commonTokens.button;
element.style.backgroundColor = buttonTokens.buttonDestructivePrimaryBgDefault;
import { button } from "@sage/design-tokens/js/es6";
element.style.backgroundColor = button.buttonDestructivePrimaryBgDefault;
A type definition file is also included to work in projects with typescript installed.
It is possible to export design tokens to any format or language. If you need to use design tokens in your technology, please contact us and describe your needs.
If you would like to help contribute to this library, please read our contributing documentation,
Licensed under the Apache License, Version 2.0 (the "License"); you may not use these files except in compliance with the License. You may obtain a copy of the License at Apache 2.0 license.
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright (c) 2025 Sage Group Plc. All rights reserved.
FAQs
Design tokens for the Sage Design System.
The npm package @sage/design-tokens receives a total of 15,994 weekly downloads. As such, @sage/design-tokens popularity was classified as popular.
We found that @sage/design-tokens demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.