Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Carta is a lightweight, fast and extensible Svelte Markdown editor and viewer, based on Marked. Check out the demo to see it in action. Differently from most editors, Carta includes neither ProseMirror nor CodeMirror, allowing for an extremely small bundle size and fast loading time.
:exclamation:Warning: sanitization is not dealt with by Carta. You need to provide a
sanitizer
in the options.
Core package:
npm i carta-md
Plugins:
npm i @cartamd/plugin-name
<script lang="ts">
import { Carta, CartaEditor } from 'carta-md';
// Component default theme
import 'carta-md/default-theme.css';
// Markdown input theme (Speed Highlight)
import 'carta-md/light.css';
const carta = new Carta({
// Remember to use a sanitizer to prevent XSS attacks
// sanitizer: mySanitizer
});
</script>
<CartaEditor {carta} />
<style>
/* Or in global stylesheet */
/* Set your custom monospace font */
:global(.carta-font-code) {
font-family: '...', monospace;
}
</style>
Editor component exported properties:
Name | Type | Description |
---|---|---|
carta | Carta | Carta Editor |
theme | string | For custom css themes, see below for more |
value | string | Markdown input |
placeholder | string | Placeholder text for textarea |
mode | 'tabs' | 'split' | 'auto' | Tabs settings |
disableToolbar | boolean | Option to disable the toolbar |
Each plugin's readme includes a guide on its use.
Name | Description |
---|---|
plugin-math | Katex support |
plugin-slash | Slash commands support |
plugin-emoji | Emojis support, including inline search |
plugin-code | Code blocks syntax highlighting |
plugin-tikz | TikZ support using TikZJax |
By using the theme
property in CartaEditor
and CartaPreview
you can change their classes to carta-editor__{theme}
and carta-viewer__{theme}
.
Check out the default theme to customize it.
If you are using a plugin, look at its readme for its customization.
Markdown highlighting is done using Speed Highlight JS, here you can find more themes.
You can find complete Markdown stylesheet online. For example github-markdown-css(used in the demo), or tailwind-typography.
Carta options:
Name | Type | Description |
---|---|---|
extensions | CartaExtension[] | Editor/viewer extensions |
rendererDebounce | number | Renderer debouncing timeout, in ms (def. 300ms) |
disableShortcuts | DefaultShortcutId[] | true | Remove default shortcuts by ids |
disableIcons | DefaultIconId[] | true | Remove default icons by ids |
disablePrefixes | DefaultPrefixId[] | true | Remove default prefixes by ids |
historyOptions | Partial<CartaHistoryOptions> | History (Undo/Redo) options |
sanitizer | (html: string) => string | HTML sanitizer |
mangle | false | Allows disabling of marked-mangle |
gfmHeadingId | GfmHeadingIdOptions | false | marked-gfm-heading-id options, or disabling |
You can easily extend Carta by creating custom plugins. Here are all the CartaExtension
properties:
Name | Type | Description |
---|---|---|
markedExtensions | marked.MarkedExtension[] | Marked extensions, more on that here |
shortcuts | KeyboardShortcut[] | Additional keyboard shortcuts |
icons | CartaIcon[] | Additional icons |
prefixes | Prefix[] | Additional prefixes |
listeners | CartaListener[] | Textarea event listeners |
components | CartaExtensionComponents | Additional components, that will be put after the editor. All components are given a carta: Carta . prop The editor has a relative position, so you can position elements absolutely |
highlightRules | HighlightRule[] | Custom markdown highlight rules. See Speed-Highlight Wiki. |
cartaRef | (carta: Carta) => void | This function can be used to access a reference to the Carta class immediately after initialization. |
shjRef | (functions: HighlightFunctions) => void | This function can be used to access a reference to all highlight functions immediately after initialization. |
If you created a plugin and want to share it, you can open an issue and we will consider sponsoring it on this guide.
Every contribution is well accepted. If you have a feature request you can open a new issue.
This package uses a pnpm workspace, so pnpm is required to download and put everything together properly.
FAQs
A lightweight, fully customizable, Markdown editor
The npm package carta-md receives a total of 806 weekly downloads. As such, carta-md popularity was classified as not popular.
We found that carta-md demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.