
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Fetch icons and assets from Figma by providing a fileId and an optional page name. Utilises per-asset export settings in the Figma document
Fikon is a CLI tool that uses the Figma API to export assets like icons and images. All you need to do is define export formats per asset in Figma.
$ yarn add --dev fikon
512w etc. are not yet supported in the API. Scales like @2x work fine)FIGMA_TOKEN)/file/: figma.com/file/<fileId>/doc-title)The script uses the component name as a file name and creates a version for each export option, appending suffixes and format to the output files.
Component names containing / or . characters get converted to _. Thus, icon/some.name with export settings of svg + @2x png results in two output files: icon_some_name.svg and icon_some_name@2x.png.
$ fikon --help
Options
--token, -t your Figma personal access token (or set the env var FIGMA_TOKEN)
--file, -f the id of the Figma file (found in the URL)
--page, -p the Page Name or node id (e.g. "453:89") from where to look for exportable assets
--output, -o destination directory, defaults to "assets/icons"
--compress compress exported files (svg/jpg/png) using imagemin
--debug enable to save the Figma API output as a .json file
Examples
$ fikon --file 1LktYuGGSqZ5zwyDnXJmCA --page Icons --output assets/icons --compress
This little utility was put together using figma-js, with much inspiration from the following libraries:
FAQs
Fetch icons and assets from Figma by providing a fileId and an optional page name. Utilises per-asset export settings in the Figma document
The npm package fikon receives a total of 0 weekly downloads. As such, fikon popularity was classified as not popular.
We found that fikon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.