Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
connect-fonts
Advanced tools
Connect/Express font serving middleware. Why? Because Google's font CDN is slow and slow page loads cause users to leave your site.
The middleware looks for requests (expressed in Express terminology):
/:font-list/fonts.css
An example of a match is:
/opensans-regular,opensans-italics/fonts.css
When this route is matched, connect-fonts will generate a CSS response with @font-face declarations that are tailored to the user's browser.
const font_middleware = require("connect-fonts");
const opensans = require("connect-fonts-opensans");
setup
function. app.use(font_middleware.setup({
fonts: [ opensans ],
allow_origin: "https://exampledomain.com",
ua: "all",
maxage: 180 * 24 * 60 * 60 * 1000 // 180 days
}));
fonts
- array of font packs.
allow_origin
- optional - origin to set in the Access-Control-Allow-Origin
header. Defaults to undefined
.
ua
- optional - force a user-agent. "all" means serve up all font types to all users. If not specified, the user's user-agent header will be used to send the user only the fonts that their user-agent support. Defaults to all
.
maxage
- optional - provide a max-age in milliseconds for http caching. Defaults to 0
.
compress
- optional - Whether to compress the CSS/font output. Defaults to false
.
<link href="/opensans-regular/fonts.css" type="text/css" rel="stylesheet"/ >
body {
font-family: 'Open Sans', 'sans-serif', 'serif';
}
It is possible to specify a host where fonts are located. This is useful if font files are located on another domain.
app.use(font_middleware.setup({
fonts: [ opensans ],
host: "https://cdn.exampledomain.com",
allow_origin: "https://exampledomain.com",
ua: "all",
maxage: 180 * 24 * 60 * 60 * 1000 // 180 days
}));
If a font pack contains locale optimised fonts, these can be requested by prepending the locale name before the font list in the fonts.css request.
<link href="/en/opensans-regular/fonts.css" type="text/css" rel="stylesheet"/ >
scripts/subset
from connect-fonts-tools can be used to create locale-optimised subsets.
One of the easiest ways to speed up your site is to minimize the number of resources that are requested. The @font-face CSS provided by fonts.css can be fetched programatically and concatinated with other site CSS during a build step.
var fontMiddleware = connect_fonts.setup(...);
// `ua` - user agent. Use 'all' for a CSS bundle that is compatible with all browsers.
// `lang` - language. generate_css can be called once for each served language, or
// "default" can be specified
// `fonts` - array of font names - e.g. ["opensans-regular", "opensans-italics"]
fontMiddleware.generate_css(ua, lang, fonts, function(err, css) {
var css_output_path = path.join(output_dir, dep);
var css_output_dir = path.dirname(css_output_path);
// create any missing directories.
mkdirp.sync(css_output_dir);
// finally, write out the file.
fs.writeFileSync(css_output_path, css.css, "utf8");
});
Once connect fonts setup function is called, a map of URLs=>paths can be retreived using fontMiddleware.urlToPaths. This information can be used in a build step for tools like connect-cachify that need access to the font file to create an caching hash.
A font pack is an npm module like any other node library. Creating a new font pack is similar to creating any npm module.
scripts/setup
utility.npm install connect-fonts-tools
cd node_modules/connect-fonts-tools
./scripts/setup
mkdir <target_path>
scripts/create_fontpack
from connect-font-tools with the source directory, the target directory, and the pack name.connect-fonts-tools/scripts/create_fontpack --pn <pack_name> --sp <source_path> --tp <target_path>
If the font pack is for public use, specify the additional parameters to be placed inside the font pack's package.json and README.md files.
connect-fonts-tools/scripts/create_fontpack --pn <pack_name> --ph <pack_homepage_url> --pr <pack_repo_url> --pb <pack_bugtracker_url> --sp <source_path> --tp <target_path>
script/check_font_pack.js
is a basic font pack linter. It will check whether pack configuration is sane and if all expected font files are available. To use it, call check_font_pack.js
with the absolute path to the font pack's configuration file.script/check_font_pack.js ~/development/connect-fonts-opensans/index.js
cd <target_path>
npm publish
npm install <pack_name>
If the font pack is not to be published to the npm repository, it can be installed to another local project directory:
cd <target_project_dir>
npm install <font_pack_directory>
MOAR font packs! See connect-fonts-tools for tools to make this easy. connect-fonts-opensans is an example of a finished font pack.
Any updates to connect-fonts are appreciated. All submissions will be reviewed and considered for merge.
This software is available under version 2.0 of the MPL:
FAQs
Middleware to serve up web fonts.
We found that connect-fonts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.