
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@spaced-out/ui-lib
Advanced tools
The Sense UI Library is a collection of portable components and utilities that can be deployed in any Sense JavaScript code base.
Because Sense code bases use webpack to resolve imports, this package does not provide bundled, ready-to-run code. Instead, it provides ready-to-build ECMAScript modules and CSS modules. This allows each application to be entirely in charge of how it bundles and splits these modules, but it also means applications must conform to a strict webpack configuration in order to use them.
Install using github. (This may change.)
yarn add git+ssh://git@github.com/Spaced-Out/ui-lib.git#3d2945e5802c16b2ac411466bc3cf9a07b6997f2
# or
# npm install --save git+ssh://git@github.com/Spaced-Out/ui-lib.git#3d2945e5802c16b2ac411466bc3cf9a07b6997f2
Then import specific modules.
// @flow
import * as React from 'react';
import classify from '@spaced-out/ui-lib/lib/classify';
export default function MyComponent({className}) {
return <div classify={classify('my-class', className)}>
Hello
</div>;
}
We use storybook to view and develop components.
npm run storybook
Generally, developers should create adjacent stories like so.
mymodule/mymodule.jsx
mymodule/mymodule.stories.jsx
These will automatically be compiled and listed in the Storybook UI.
All code should be type safe using Flow. (We may add TypeScript support later.) You can check code using the check script.
npm run check
We use the Jest testing library. The preferred file name for tests is an adjacent .test file like so.
myutil/myutil.js
myutil/myutil.test.js
We use gulp (I know) to transpile our modules. Currently, built code should be committed and pushed to the repo, but in the future we may use NPM for this.
npm run build
git add lib
git commit
git push
We can take advantage of hash-tagged-releases to do test builds of the ui lib, a one-liner that sort of automates this looks like:
HASHVER=$(git rev-parse --short=9 head) npm version "0.0.0-${HASHVER}" && npm publish && npm dist-tag add "@spaced-out/ui-lib@0.0.0-${HASHVER}" next
this grabs the current short hash, sets the version of the library, and then publishes while adding a dist-tag for "next" with the current hash version. Anyone who installs @spaced-out/ui-lib@next will get this version. it's intentionally meant to be fragile, although the hashed version will remain stable for some time.
this is a reasonable way to reference a build for staging.
FAQs
the place for all our uis
The npm package @spaced-out/ui-lib receives a total of 242 weekly downloads. As such, @spaced-out/ui-lib popularity was classified as not popular.
We found that @spaced-out/ui-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.