Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@sajari-ui/core
Advanced tools
This is a work in progress of the Sajari UI component library, based on Tailwind.
We're going to build components using Tailwind but rather than expose the className
prop on all components and let it be a free-for-all, we're going to go for an approach similar to styled system using style props but rather than m={4}
we have to use the full className so purgeCSS
works correctly so our version of that would be margin="m-4"
. We're also using TypeScript so all classNames have to be in their own type - e.g. a Margin
type would contain all possible margin classNames, including any variants.
To install the production package run yarn add @sajari-ui/core
.
To develop locally, you can link the package using yarn:
yarn link
in this folder (/packages/sajari-ui
). This will link all local installs to this package.yarn link "@sajari-ui/core"
and then yarn add @sajari-ui/core@link:0.1.0
to install the package.yarn add -D postcss postcss-clean postcss-cli autoprefixer
yarn add tailwindcss
Create the base stylesheet. Later this will be included in the package.
/* purgecss start ignore */
@tailwind base;
@tailwind components;
/* purgecss end ignore */
@tailwind utilities;
Create a postcss config with this as the content:
const { tailwindConfig } = require('@sajari-ui/core');
tailwindConfig.purge = {
mode: 'all',
content: ['./src/**/*.tsx', '../../node_modules/@sajari-ui/core/dist/*.js'],
};
module.exports = {
plugins: [
require('tailwindcss')(tailwindConfig),
require('autoprefixer'),
require('postcss-clean')({
level: 2, // Merge duplicated declarations
}),
],
};
🚨 NOTE: The tailwindConfig.purge.content
paths need to be updated to suit your application.
🚨 NOTE: The CSS will be purged for production builds only. To enable it always, you can set tailwindConfig.purge.enabled
to true
. Unfortunately we have to set mode
to all
to allow for the classNames in our package to stay in the CSS.
Preact CLI and Next come with PostCSS already setup so all you need to do is import the CSS file in your app and it'll get processed via PostCSS. Sadly Create React App isn't so awesome so you need to create an npm script to do it.
Before:
"scripts": {
"start": "react-scripts start",
"build": "react-scripts build",
"test": "react-scripts test",
"eject": "react-scripts eject"
}
After:
"scripts": {
"build:css": "postcss src/styles/index.css -o src/index.css",
"watch:css": "postcss -w src/styles/index.css -o src/index.css",
"prestart": "npm run prebuild",
"prebuild": "npm run build:css",
"start": "run-p watch:css start:react",
"start:react": "react-scripts start",
"build": "react-scripts build",
"test": "react-scripts test",
"eject": "react-scripts eject"
}
🚨 NOTE: You need to adjust the paths to the CSS file depending on your application. You'll also need to import the processed CSS - /src/index.css
in the example above in your app.
The types created can be used in props as-is or as categorized sets.
CommonProps
- display
, margin
, padding
LayoutProps
- display
, width
, height
, minWidth
, minHeight
, maxWidth
, maxHeight
PositionProps
- position
, zIndex
, offset
(top, right, bottom, left)FlexProps
- flexDirection
, flexWrap
, alignItems
, alignContent
, justifyContent
, order
FlexItemProps
- alignSelf
, flex
, flexGrow
, flexShrink
The index.ts
file in /src/types
also exports the relevant keys for the categories. These are useful for mapping the props to classNames.
When consuming the prop categories, you can use two helpers to generate the classNames:
mapClassNames
(/src/utils/styles/map-classnames.ts
) - The arguments are props
and keys
. Keys needs to contain the keys for the props you wish to convert to classNames.filterObject
(/src/utils/object/filter.ts
) - Filter out keys from props - useful for doing {...rest}
type stuff where you don't want the props to bleed to the DOM element.We've created a build script to build the TypeScript types based on the Tailwind config. In /scripts/types
there are two files:
types.js
- An array of objects containing all the types we want to build.build.js
- The actual build script to parse the config and create the types.If you need to add a missing type or update them, you can run yarn build:types
. The types are committed to source control so this shouldn't need to be run often - only when a change is made to the Tailwind config or we upgrade Tailwind and they add features.
FlexItemProps
)FAQs
Sajari UI Component Library
The npm package @sajari-ui/core receives a total of 11 weekly downloads. As such, @sajari-ui/core popularity was classified as not popular.
We found that @sajari-ui/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.