Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@uxpin/merge-cli
Advanced tools
The Command-line tool integrates the Design System repository with: https://www.uxpin.com/merge
The Command-line tool integrates the Design System repository with UXPin Merge
Add uxpin-merge
to your package.json:
npm install @uxpin/merge-cli --save-dev
or
yarn add @uxpin/merge-cli --dev
This tool recognizes components available in your repository of component library, analyze them and uploads results to UXPin app in order to further integration with UXPin Design System services.
./node_modules/.bin/uxpin-merge --help
will print the list of options:
Usage: uxpin-merge [options] [command]
`uxpin-merge` starts up an experimentation mode for the project in the CWD. See more commands below.
Options:
-v, --version output the version number
--webpack-config <path> path to a custom webpack config, relative to the current working directory
--wrapper <path> path to a custom component wrapper, relative to the current working directory
--cwd <path> working directory: path to root of the DS repository. Default: `./`
--config <path> path to a config file. Default: `./uxpin.config.js`
--port <number> port number on which the local server will listen. Default: 8877
--uxpin-domain <domain> Can be used to set a UXPin private cloud domain. Default: `uxpin.com`
--skip-browser Don't open browser on start
--disable-tunneling Turn off tunneling via ngrok
-h, --help output usage information
Commands:
server [options] Start local web server and display the list of design system components
push [options] Upload design system repository information to UXPin
dump [options] Shows all information (in JSON) about the design system repository and NOT send to UXPin
summary [options] Show only design system summary without building it
FAQs
The Command-line tool integrates the Design System repository with: https://www.uxpin.com/merge
The npm package @uxpin/merge-cli receives a total of 135 weekly downloads. As such, @uxpin/merge-cli popularity was classified as not popular.
We found that @uxpin/merge-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.