
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@servicetitan/anvil2
Advanced tools
Anvil2 contains reusable components, fonts, icons, and more for building ServiceTitan products.
We recommend installing Anvil2 by running the following npm
command (or the equivalent yarn
/pnpm
command) in your project folder:
npm install @servicetitan/anvil2
If you are using a Micro Front End (MFE) with the light bundle, the version of @servicetitan/anvil2
that is installed in the host app will be used when the MFE is loaded within the host app. If you need features or bug fixes from newer versions, update the version in the host app first.
Components can be imported as named exports from the package root:
import { Button, Icon } from "@servicetitan/anvil2";
Anvil2 icons are expected to be used with the SVGR library, which will import SVGs as React components. SVGR should already be part of the latest @servicetitan/startup
Webpack configuration.
Importing and using an icon:
import { Button, Icon } from "@servicetitan/anvil2";
import Warning from "@servicetitan/anvil2/assets/icons/material/round/warning.svg";
import Star from "@servicetitan/anvil2/assets/icons/material/round/star.svg";
import LocalSettings from "@servicetitan/anvil2/assets/icons/st/local_settings.svg";
export const Example = () => (
<>
<Icon svg={Warning} size="large" />
<Button icon={Star} aria-label="Favorite" />
<Button icon={LocalSettings}>Settings</Button>
</>
);
A set of CSS Utils classes are available. See the source code in our repo to see the full list.
import { Card } from "@servicetitan/anvil2";
import "@servicetitan/anvil2/assets/css-utils/utils.css";
export const Example = () => (
<>
<Card className="m-inline-4">Card with inline margin</Card>
</>
);
utils.css
file is already loaded by the host app, you might not need to import it.:not(.aXNw) [data-anv='text']
, you will need to instead add the styles you want in a custom className
, and add an @layer
around it:@layer application {
/* replaces .c-danger */
.custom-class {
color: var(--status-color-danger);
}
}
We are actively working on a long-term solution with the Front-End Platform team.
AnvilProvider
When using the Anvil2 component library, we recommend wrapping the top level of your app in the AnvilProvider
component, which also supports light/dark themes, localization, and data-tracking-id
configurations:
import { AnvilProvider } from "@servicetitan/anvil2";
<AnvilProvider themeData={...} localizationData={...} trackingIdData={...}>
...
</AnvilProvider>
In order to enable consistent FullStory data tracking with Anvil2 components, a data-tracking-id
is automatically generated for all interactive components. This id will only change if certain props change, which are determined on a per-component basis.
If your team or product already has a different strategy for tagging components in place, you can disable the auto-generated data-tracking-id
tags using the AnvilProvider.trackingIdData
or TrackingProvider.optOut
:
// Using AnvilProvider
<AnvilProvider trackingIdData={{ optOut: true }}>...</AnvilProvider>
// Using TrackingProvider
<TrackingProvider scope="ST" optOut>...</TrackingProvider>
You can read the Anvil2 docs at: https://anvil.servicetitan.com/
We welcome contributions of all kinds from design to code!
Please reach out to our team in #ask-designsystem if you would like to make a contribution.
Check out the root-level Contributing docs for more details on making changes to this package.
FAQs
Anvil2 React Library
We found that @servicetitan/anvil2 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.