
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@svg-toolkit/svg-format
Advanced tools
Structural formatter for SVG documents.
npm install -g svg-format # unscoped alias
npm install -g @svg-toolkit/svg-format # canonical package
svg-format icon.svg
npx svg-format icon.svg
@svg-toolkit/svg-format is the canonical package; unscoped svg-format is a
thin alias that depends on it. Either install gives you the same bin. Or grab
the whole toolkit at once with
@kjanat/svg-toolkit.
The package resolves a prebuilt native binary for your platform via
optionalDependencies — no postinstall step, no network access at runtime.
Formatting behavior and options: https://github.com/kjanat/svg#readme
use svg_format::{
format,
format_with_options,
AttributeLayout,
AttributeSort,
FormatOptions,
QuoteStyle,
WrappedAttributeIndent,
};
let pretty = format(source);
let pretty_custom = format_with_options(
source,
FormatOptions {
indent_width: 4,
insert_spaces: false,
max_inline_tag_width: 100,
attribute_sort: AttributeSort::Canonical,
attribute_layout: AttributeLayout::Auto,
attributes_per_line: 1,
space_before_self_close: true,
quote_style: QuoteStyle::Preserve,
wrapped_attribute_indent: WrappedAttributeIndent::OneLevel,
},
);
svg-format is also available as a CLI binary from the same crate
(cargo install svg-format, or npm install --global svg-format /
@svg-toolkit/svg-format for the prebuilt binary).
# Format from stdin to stdout
cat icon.svg | svg-format --stdin
# Check whether a file would change
svg-format --check icon.svg
# Format file in place
svg-format --in-place icon.svg
FAQs
Structural formatter for SVG documents.
The npm package @svg-toolkit/svg-format receives a total of 2 weekly downloads. As such, @svg-toolkit/svg-format popularity was classified as not popular.
We found that @svg-toolkit/svg-format demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.