Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@smg-automotive/components
Advanced tools
Install the package
npm install @smg-automotive/components
run the setup script
npx components setup --path=<path to you public dir>
The setup script will:
postinstall
script that will copy self hosted fonts to your public directory. They need to be served from /assets/fonts
to be correctly loaded..gitignore
Default path
is public
, which is the publicly available directory in nextjs projects.
After postinstall
script is added fonts will be copied every time you install the dependencies, you don't need to manually copy fonts after updating the components package.
Dealing with fonts
There are three ways of making sure that fonts are loaded:
self-hosting fonts and using provided fonts/hosted
module.
To leverage it:
/assets/fonts
<Fonts />
component from:import Fonts from '@smg-automotive/components/fonts/hosted'
const App: () => {
// ...
return (<>
<Fonts />
<!-- rest of the application -->
</>)
}
The provided component makes sure that correct font-face
s are declared
using @next/fonts
to leverage font optimizations from nextjs
Unfortunately due to technical limitations in how @next/fonts
are set up we can't provide a module similar to self-hosted fonts. We do the next best thing and provide a component generator. Simply run:
npx components setup-next-fonts --fonts-path <path-to-which-fonts-were-copied> --component-path <path-to-save-the-component>
This will generate the <Fonts />
component with the @next/font
configuration ready to use in your project.
handling fonts yourself
You can also deal with the fonts yourself. That means you're responsible for declaring font-face
and hosting fonts. The only thing that you need to do is to provide a --font-primary
CSS variable so the components package picks your font declaration up:
:root {
--font-primary: '<your font family name>'
}
We recommend adding fallback font families of Arial, Helvetica, Sans-Serif
npm run build
You can link your local npm package to integrate it with any local project:
cd smg-automotive-components-pkg
npm run build
cd <project directory>
npm link ../smg-automotive-components-pkg
As agreed upon in the RFC we will handle the differences between AS24 and MS24 with two different themes. They can be then used via a theme provider that needs to wrap the application:
// app.tsx
import { ThemeProvider } from '@smg-automotive/components';
const App = ({ Component, pageProps }) => {
return (
<ThemeProvider theme="autoscout24">
<Component {...pageProps} />
</ThemeProvider>
);
};
export default MyApp;
Theme objects can also be imported directly from the package (for showcasing, debugging, etc.):
import { autoScout24Theme } from '@smg-automotive/components';
We leverage a theming addon in storybook. It allows us to use top bar to switch themes.
New versions are released on the ci using semantic-release as soon as you merge into master. Please make sure your merge commit message adheres to the corresponding conventions.
FAQs
SMG Automotive components library
The npm package @smg-automotive/components receives a total of 1,069 weekly downloads. As such, @smg-automotive/components popularity was classified as popular.
We found that @smg-automotive/components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.