
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
json-render-cli
Advanced tools
Token-efficient Node.js CLI that renders a JSON UI spec into a PNG image using @json-render/react + Playwright headless Chromium.
Use this when you want image output with lower prompt overhead than hand-written HTML/CSS:
npm install
npx playwright install chromium
npm run build
json-render -m '<json>' -c ./config.json -o stdout --size 1200x630
Options:
-m, --message <json>: Required. JSON string for UI spec (direct inline JSON only).-c, --config <path>: Optional. Path to config JSON. Default: ./config.json.-o, --output <stdout|filePath>: Optional. Default: stdout.--size <WIDTHxHEIGHT>: Optional viewport override.Output behavior:
stdout (default): prints pure PNG Base64 (no data URL prefix).-m)The CLI validates input with AJV JSON Schema before rendering.
root + elements){
"root": "root",
"elements": {
"root": {
"type": "Container",
"props": { "height": "100%" },
"children": ["title"]
},
"title": {
"type": "Heading",
"props": { "text": "Hello" }
}
}
}
root nested element){
"root": {
"type": "Container",
"children": [
{
"type": "Heading",
"props": { "text": "Hello" }
}
]
}
}
Tree spec is normalized to the flat structure internally.
config.json is validated with Zod.
{
"version": 1,
"catalog": {
"allowedComponents": ["Container", "Card", "Heading", "Text", "Button"],
"componentDefaults": {
"Card": { "padding": 20 }
}
},
"theme": {
"mode": "system",
"fontFamily": "ui-sans-serif, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif",
"textColor": "#0f172a",
"headingColor": "#020617",
"mutedTextColor": "#475569",
"cardBackground": "#ffffff",
"cardBorderColor": "#e2e8f0",
"dark": {
"textColor": "#e2e8f0",
"headingColor": "#f8fafc",
"mutedTextColor": "#94a3b8",
"cardBackground": "#0f172a",
"cardBorderColor": "#334155",
"canvasBackground": "#020617"
},
"borderRadius": 16,
"spacing": 12
},
"viewport": {
"width": 1200,
"height": 630,
"deviceScaleFactor": 2
},
"screenshot": {
"type": "png",
"omitBackground": false,
"fullPage": false
},
"canvas": {
"background": "#f8fafc",
"padding": 24
}
}
If catalog.allowedComponents is empty/missing, all built-in components are allowed.
theme.mode supports light, dark, and system (default). system follows prefers-color-scheme.
For variable row counts (for example, table cells wrapping to multiple lines), set
screenshot.fullPage to true to avoid clipping the bottom rows.
ContainerRowColumnCardHeadingTextBadgeDividerSpacerButtonImage# Flat spec to file
npm run dev -- -m "$(cat examples/ui-flat.json)" -c examples/config.json -o /tmp/render.png
# Tree spec to stdout(base64)
npm run dev -- -m "$(cat examples/ui-tree.json)" -c examples/config.json -o stdout
npm test
Integration screenshot test runs only when Playwright Chromium binary is available.
npm run release:check
npm run release:latest
release:check runs build + tests + npm pack --dry-run.
release:latest publishes with --tag latest after checks pass.
This package ships with one reusable Codex skill:
skills/use-json-render-cli/SKILL.md (unified router for table, ticket-table, info-cards, announcement-cards, and flow-summary use cases)After global install (npm i -g json-render-cli), you can find it under your global node_modules path, for example:
$(npm root -g)/json-render-cli/skills/use-json-render-cli/SKILL.mdFAQs
CLI for rendering JSON UI spec to PNG via json-render and Playwright
We found that json-render-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.