
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Automatic font fallback based on font metrics
On the playground project, enabling/disabling fontaine
makes the following difference rendering /
, with no customisation required:
Before | After | |
---|---|---|
CLS | 0.24 | 0.054 |
Performance | 92 | 100 |
With pnpm
pnpm add -D fontaine
Or, with npm
npm install -D fontaine
Or, with yarn
yarn add -D fontaine
import { FontaineTransform } from 'fontaine'
const options = {
fallbacks: ['BlinkMacSystemFont', 'Segoe UI', 'Helvetica Neue', 'Arial', 'Noto Sans'],
// You may need to resolve assets like `/fonts/Roboto.woff2` to a particular directory
resolvePath: (id) => 'file:///path/to/public/dir' + id,
// overrideName: (originalName) => `${name} override`
// sourcemap: false
}
// Vite
export default {
plugins: [FontaineTransform.vite(options)]
}
// Next.js
export default {
webpack(config) {
config.plugins = config.plugins || []
config.plugins.push(FontaineTransform.webpack(options))
return config
},
}
// Docusaurus plugin - to be provided to the plugins option of docusaurus.config.js
// n.b. you'll likely need to require fontaine rather than importing it
const fontaine = require('fontaine')
function fontainePlugin(_context, _options) {
return {
name: 'fontaine-plugin',
configureWebpack(_config, _isServer) {
return {
plugins: [
fontaine.FontaineTransform.webpack(options),
],
};
},
};
}
// Gatsby config - gatsby-node.js
const { FontaineTransform } = require('fontaine')
exports.onCreateWebpackConfig = ({ stage, actions, getConfig }) => {
const config = getConfig()
config.plugins.push(FontaineTransform.webpack(options))
actions.replaceWebpackConfig(config)
}
// Astro config - astro.config.mjs
import { defineConfig } from 'astro/config'
import { FontaineTransform } from 'fontaine'
export default defineConfig({
integrations: [],
vite: {
plugins: [
FontaineTransform.vite({
fallbacks: ['Arial'],
resolvePath: (id) => new URL(`./public${id}`, import.meta.url), // id is the font src value in the CSS
}),
],
},
})
Note If you are using Nuxt, check out nuxt-font-metrics which uses
fontaine
under the hood.
If your custom font is used through the mechanism of CSS variables, you'll need to make a tweak to your CSS variables to give fontaine a helping hand. Docusaurus is an example of this, it uses the --ifm-font-family-base
variable to reference a custom font. In order that fontaine can connect the variable with the font, we need to add a {Name of Font} override
suffix to that variable. What does this look like? Well imagine we were using the custom font Poppins which is referenced from the --ifm-font-family-base
variable, we'd make the following adjustment:
:root {
/* ... */
- --ifm-font-family-base: 'Poppins';
+ --ifm-font-family-base: 'Poppins', 'Poppins override';
Behind the scenes, there is a 'Poppins override' @font-face
rule that has been created by fontaine. By manually adding this override font family to our CSS variable, we make our site use the fallback @font-face
rule with the correct font metrics that fontaine generates.
fontaine
will scan your @font-face
rules and generate fallback rules with the correct metrics. For example:
@font-face {
font-family: 'Roboto';
font-display: swap;
src: url('/fonts/Roboto.woff2') format('woff2'), url('/fonts/Roboto.woff')
format('woff');
font-weight: 700;
}
/* This additional font-face declaration will be added to your CSS. */
@font-face {
font-family: 'Roboto override';
src: local('BlinkMacSystemFont'), local('Segoe UI'), local('Helvetica Neue'),
local('Arial'), local('Noto Sans');
ascent-override: 92.7734375%;
descent-override: 24.4140625%;
line-gap-override: 0%;
}
Then, whenever you use font-family: 'Roboto'
, fontaine
will add the override to the font-family:
:root {
font-family: 'Roboto';
/* This becomes */
font-family: 'Roboto', 'Roboto override';
}
corepack enable
(use npm i -g corepack
for Node.js < 16.10)pnpm install
pnpm dev
; launch a vite server using source code with pnpm demo:dev
This would not have been possible without:
Made with ❤️
Published under MIT License.
FAQs
Automatic font fallback based on font metrics
The npm package fontaine receives a total of 54,546 weekly downloads. As such, fontaine popularity was classified as popular.
We found that fontaine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.