Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
minidenticons
Advanced tools
Super lightweight SVG identicon generator. No dependencies.
(using the minidenticon()
function only)
(using the included custom element)
Play with it here.
Minidenticons uses ES modules, now widely supported in browsers. Import the minidenticonSvg
custom element from the minidenticons.min.js
file. This file can be located in a CDN (example below) or copied in any directory of your website (for better performance and to be GDPR compliant, since you don’t have to connect to a third party server).
<script type="module">
import { minidenticonSvg } from 'https://cdn.jsdelivr.net/npm/minidenticons@4.2.1/minidenticons.min.js'
</script>
Then simply use minidenticon-svg
tags with a username
attribute :joy:
<minidenticon-svg username="laurent"></minidenticon-svg>
(Note that like for all elements except void elements, the closing tag </minidenticon-svg>
is required)
For instance with the laurent
username you will get the following identicon (without the border):
For easy CSS styling:
Minidenticons are SVG images that will take all the space available. The picture above is resized.
The background is transparent.
There is white space around the colored square matrix to allow uncropped circle avatars.
So with the following CSS:
minidenticon-svg svg {
border-radius: 50%;
background-color: grey;
height: 48px;
width: 48px;
};
You will get:
By default the color saturation is set to 95% and the lightness is set to 45%. But you can change these values with the saturation
and/or lightness
attributes, for instance:
<minidenticon-svg username="laurent" saturation="60" lightness="50"></minidenticon-svg>
Play with the demo to find a combination of saturation and lightness that matches your website theme colors: light, dark or whatever :sunglasses:
minidenticon()
functionInstead of using the custom element, you can also use the minidenticon()
function to generate SVG strings in your client (or your server).
minidenticon(seed: string, saturation?: number|string, lightness?: number|string, hashFn?: (str: string) => number): string
The minidenticon()
function will return a SVG string generated from its seed string argument. The seed argument can be a username, but actually any string used as an identifier.
Optional saturation and lightness arguments should be percentages; that is, numbers (or strings) between 0 and 100.
If you need to, you can use your own hash function as argument of the fourth parameter (optional). Your custom hash function must take a string and return a number. The last 15 bits of the integer part of the hash will be used to draw the squares. The included custom element does not use this last parameter.
Note that the minidenticon()
function itself is not memoized.
Be sure to use a NodeJS version greater or equal to 15.14.0.
npm install minidenticons
import { minidenticon } from 'minidenticons'
The minidenticonSvg
custom element should be tree-shaken from your bundle, for an even smaller size of minidenticons :grin:
The minidenticon()
function is fast. You can see by yourself if you run node benchmark/node
at the root of a Minidenticons git clone. On my machine I get the following result:
Time to generate 10000 minidenticon SVG strings for 15 characters random seeds:
8 milliseconds (10 runs average)
The following React component example inserts the identicon into an img
tag src
attribute. It also uses React useMemo
to memoize the identicon.
import { minidenticon } from 'minidenticons'
import { useMemo } from 'react'
const MinidenticonImg = ({ username, saturation, lightness, ...props }) => {
const svgURI = useMemo(
() => 'data:image/svg+xml;utf8,' + encodeURIComponent(minidenticon(username, saturation, lightness)),
[username, saturation, lightness]
)
return (<img src={svgURI} alt={username} {...props} />)
}
You can then use this component with img
props such as width
and height
along with minidenticons ones. All props except username
are optional.
<MinidenticonImg username="laurent" saturation="90" width="150" height="150" />
For a TypeScript version of this example see the original issue comment by Dan Yishai.
In this example using Workbox, images with a path ending with minidenticons/<username>.svg
are generated by the service worker and cached for one year.
import { minidenticon } from 'minidenticons'
import { registerRoute } from 'workbox-routing'
registerRoute(
/minidenticons\/[^\/]+\.svg$/,
async ({ url }) => {
const username = url.pathname.match(/([^\/]+)\.svg$/)[1]
return new Response(
minidenticon(username),
{ headers: { "Content-Type": "image/svg+xml", "Cache-Control": "max-age=31536000" } }
)
}
)
A Rust port of Minidenticons was made by Théo Battrel: minidenticons-rs
.
For Elm enthusiasts there is a Minidenticons package on the Elm package repository: minidenticons-elm
.
You will always get the same identicon for a given username. But it is not impossible to have different usernames with the same identicon. That's a collision.
Generated identicons are 5×5 matrices with vertical symmetry, and can have 9 different hues for the same saturation and lightness. This means there are 2(3×5) × 9 = 294,912 different identicons possible, but duplicate identicons are inevitable when using a lot of them. It shouldn’t matter as identicons should not be used solely to identify an user, and should always be coupled to a unique username :wink:
The npm test
command results below show that you have less than a 2 percent chance to generate a duplicate identicon when already using 10,000 of them.
0 collisions out of 100 (0.00%)
0 collisions out of 200 (0.00%)
0 collisions out of 300 (0.00%)
0 collisions out of 400 (0.00%)
0 collisions out of 500 (0.00%)
0 collisions out of 600 (0.00%)
0 collisions out of 700 (0.00%)
0 collisions out of 800 (0.00%)
1 collisions out of 900 (0.11%)
1 collisions out of 1000 (0.10%)
8 collisions out of 2000 (0.40%)
14 collisions out of 3000 (0.47%)
22 collisions out of 4000 (0.55%)
37 collisions out of 5000 (0.74%)
58 collisions out of 6000 (0.97%)
75 collisions out of 7000 (1.07%)
99 collisions out of 8000 (1.24%)
129 collisions out of 9000 (1.43%)
163 collisions out of 10000 (1.63%)
4.2.1
2024-03-01
FAQs
Super lightweight SVG identicon (icon avatar) generator
The npm package minidenticons receives a total of 2,133 weekly downloads. As such, minidenticons popularity was classified as popular.
We found that minidenticons demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.