Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Automate the generation of design tokens and specs from your Figma documents. Inspired by [Salesforce Theo](https://github.com/salesforce-ux/theo).
Automate the generation of design tokens and specs from your Figma documents. Inspired by Salesforce Theo.
There's a lot to say here about the use cases and approaches taken by other tools. I will be writing an article on the motivations behind the project later on.
The basic idea of Figmagic is to support an informed handoff between designers and developers. I believe the best way to do this in a solid, mature, and non-impeding way is:
An example project—using React, Webpack and Styled Components—is available at https://github.com/mikaelvesavuori/figmagic-example.
You can use Figmagic either as an NPM package in its own folder, or as part of your projects. It is assumed you will use it as a dependency.
Running it standalone might be fine if you wish to isolate the tokens/spec generation, or if you don't have a project in which to place Figmagic, or if it simply makes more sense to have it on its own (for example doing a project in a non-Node environment).
Use .
as a value in the path in the NPM config block to resolve from the Figmagic root.
You will probably want to use it as a straight dependency.
yarn add figmagic -S
or npm install figmagic -S
The Figmagic commands (NPM scripts block) is below, listing what commands are available to you.
"config": {
"figmagicPath": "node_modules/figmagic"
},
"scripts": {
"figmagic": "yarn figmagic:clean && yarn run figmagic:saveFromApi && yarn figmagic:build && yarn figmagic:getImages && yarn figmagic:downloadImages",
"figmagic:clean": "rm -rf specs/ && rm -rf tokens/ && rm -rf figma",
"figmagic:saveFromApi": "mkdir -p figma && wget 'https://api.figma.com/v1/files/{FILE}' --header='X-Figma-Token: {TOKEN}' -O figma/figma.json",
"figmagic:tokens": "yarn figmagic:clean && yarn figmagic:saveFromApi && yarn figmagic:build",
"figmagic:build": "node $npm_package_config_figmagicPath/bin/index.js",
"figmagic:getImages": "node $npm_package_config_figmagicPath/bin/getImages.js",
"figmagic:downloadImages": "node $npm_package_config_figmagicPath/bin/downloadImages.js"
}
See a demo/template at https://www.figma.com/file/KLLDK9CBSg7eAayiTY3kVqC8/Figmagic-Design-System-Example.
Uses any combination of rows, columns, and grid (but only one of each type).
Postscript name (eg. FiraSans-Regular).
Work in progress.
Rem units based on global font size (base 16px, change this within Figmagic also, if you've altered this value in your CSS).
Unitless.
RGBA colors.
Em units.
Text to come.
bin
contains the project's JS filesfigma
will contain the extracted Figma JSON and various build-time JSON filestokens
will contain the token files (in .js format)specs
will contain specifications for all Master Componentsspecs/images
will contain generated images for your componentsFAQs
Figmagic is the missing piece between DevOps and design: Generate design tokens, export graphics, and extract design token-driven React components from your Figma documents.
The npm package figmagic receives a total of 2,372 weekly downloads. As such, figmagic popularity was classified as popular.
We found that figmagic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.