
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
smart-icon
Advanced tools
import { define, SVGUseAdapter } from "smart-icon";
// Define your icon name and configuration
define("my-icon", {
adapter: SVGUseAdapter,
resolvePath: (name) => `/icons/${name}.svg#icon`
});
// Render it
<p>Hello <my-icon name="world"></my-icon></p>
A generic component library should strive to integrate well into any existing design system or application. Typically this means leaving styling (CSS) up to the consumer of the library, but until now there was no simple, flexible, and framework-agnostic way to keep icons decoupled from JavaScript. smart-icon is a tiny web component that dynamically resolves an icon’s name to a path at runtime with support for a variety of icon formats and loading methods.
This adapter is great for loading SVGs directly into the DOM by leveraging the <use /> element. It allows icons to be stylable via CSS, such as changing the fill color on hover for example, and is flexible with both SVG sprite sheets or (preferably for performance reasons) standalone SVG icons.
If you don’t want to require JavaScript support for your application, you can use SSR (not yet documented) to directly render the output of smart-icon into HTML. You will lose the flexibility of runtime path resolution, but this allows you to wait until build time to configure the icon pack that’s used.
FAQs
A hot-swappable icon loader for component libraries and themeable apps
We found that smart-icon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.