
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
orange-design-system
Advanced tools
node >= 6.9.0npm installnpm run build (postinstall hook should run npm run build automatically after installation)This project can be used as npm dependency which includes all components with styles and other static assets.
npm > 6.x.xnpm install npm install bitbucket:lightingbeetle/orange-design-system --save
Above install master branch of this repository. For more granular control you can specify version specified as git tag via (recommended):
npm install bitbucket:lightingbeetle/orange-design-system#semver:~1.0.0 --save
This outputs:
...
"dependencies": {
...
"orange-design-system": "bitbucket:lightingbeetle/orange-design-system#semver:1.0.0",
...
}
...
npm link orange-design-system
or install this repository via relative path in your project
{
...
dependencies: {
"orange-design-system": "./relative/path/to/this/repository/styleguide"
},
...
}
Entry point of npm dependency is build/components/index.js which contains UMD build of all React components specified in src/components/index.js.
You can import components directly from this package:
import { Button } from 'orange-design-system';
CSS is outputted into build/components/ folder. In most cases, two CSS files files are important:
style.css which includes global CSS rules and also components rulesfonts.css which includes font definitionsOther static assets such as SVG icon sprite or fonts are also in the build/ folder.
Icons are using SVG sprite with reference on external file named sprite.svg. You need to store this file from build/sprite.svg somewhere in your project (or web-server) and fix-up path to the sprite file like on example below.
import { Icon } from '@orange/orange-design-system'
export const MyIcon = props => (
<Icon spritePath="/my/public/path" {...props} />
);
React.js is excluded from components library and it's expected that is available in upper scope.
Runtime polyfills are not included inside bundle and library expects that polyfills listed below are available in upper scope.
After creation, your project should look like this:
my-app/
README.md
node_modules/
package.json
public/
index.html
favicon.ico
src/
assets/
components/
docs/
layouts/
pages/
scripts/
styleguide/
styles/
utils/
pollyfils.js
index.js
For the project to build, these files must exist with exact filenames:
public/index.html is the styleguide template;src/index.js is the App JavaScript entry point.src/styleguide/index.js is the Styleguide JavaScript entry point.You can delete or rename the other files.
src/assets is for static assets: icons, etc..src/components is for components definition.src/docs is for global docs.src/layouts is for page layouts.src/pages is for templates of pages.src/scripts is for global scripts.src/styles is for global styles.src/utils is for global JS utils.src/styleguide is where styleguide lives.You may create subdirectories inside src. For faster rebuilds, only files inside src are processed by Webpack.
You need to put any JS and CSS files inside src, otherwise Webpack won’t see them.
In the project directory, you can run:
npm startRuns the app in the development mode.
Open http://localhost:3000 to view it in the browser.
The page will reload if you make edits.
You will also see any lint errors in the console.
npm run buildRuns build:app and build:lib
npm run build:appBuilds the app for production to the build folder.
It correctly bundles React in production mode and optimizes the build for the best performance.
The build is minified and the filenames include the hashes.
Your app is ready to be deployed!
See the section about deployment for more information
npm run build:libRuns production build of all components from src/components. Outputs ES5 compatible bundle as UMD package.
This project supports a superset of the latest JavaScript standard.
In addition to ES6 syntax features, it also supports:
Learn more about different proposal stages.
Runtime supported pollyfils:
If you use any other ES6+ features that need runtime support (such as Symbol or Promises), make sure you are including the appropriate polyfills manually, or that the browsers you are targeting already support them.
npm run build creates a build directory with a production build of your app. Set up your favourite HTTP server so that a visitor to your site is served index.html, and requests to static paths like /static/js/main.<hash>.js are served with the contents of the /static/js/main.<hash>.js file.
Lighter consists of @lighting-beetle/lighter-react-scripts which is a development dependency in the projects (including this one).
To update an existing project to a new version of @lighting-beetle/lighter-react-scripts, open the changelog, find the version you’re currently on (check package.json in this folder if you’re not sure), and apply the migration instructions for the newer versions.
In most cases bumping the lighter-react-scripts version in package.json and running npm install in this folder should be enough, but it’s good to consult the changelog for potential breaking changes.
We are always open to your feedback.
This project was build with Lighter - Lighting Beetle's living styleguide.
FAQs
## Local installation
We found that orange-design-system demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.