Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Typr.ts is a TypeScript conversion of Typr.js.
Typr.ts is a TypeScript parser and utility for working with fonts (TTF, OTF). It is an alternative to opentype.js. It is the main text engine for Photopea image editor.
Typr.ts consists of static functions only, it can be easily rewritten into C or any other procedural language. There are no constructors, no methods, no complex structure. It consists of two independent parts (separate files):
Typr
- main parser, parses the raw data, generates the font object.TyprU
- Typr utilities. Basic operations with fonts. Use it as a guide to write your own utilities.npm install typr-ts --save
npm run webpack
: The development server starts on port 9003 by default. So then navigate to localhost:9003
to view the demo.
npm run webpack-prod
: Output will be in the {root}/dist folder.
import { Typr } from "typr-ts";
Typr.parse(buffer)
buffer
: ArrayBuffer, binary data of the TTF or OTF fontThe output object has a structure, wich corresponds to the structure of the TTF/OTF file. I.e. it is a set of tables, each table has its own structure.
var font = Typr.parse(buffer);
console.log(font);
import { TyprU } from "typr-ts";
TyprU.codeToGlyph(font, code)
font
: font objectcode
: integer code of the characterTyprU.stringToGlyphs(font, str)
font
: font objectstr
: standard JS stringTyprU.getPairAdjustment(font, gid1, gid2)
font
: font objectgid1
: index of the first glyphgid2
: index of the second glyphTyprU.glyphToPath(font, gid)
font
: font objectgid
: index of the glyph, which you want to accessTypr.js uses the following structure to represent the path:
{ cmds: [CMD,CMD,CMD, ...], crds:[X,Y,X,Y, ...] }
cmds
is an array of commands (Strings), crds
is an array of coordinates (Numbers). Each command needs a specific number of coordinates. The path can be processed by passing both arrays from the left, index into crds
depends on the types of previous commands.
A "raindrop" shape: { cmds:["M","L","Q","Z"], crds:[0,0,20,80,0,120,-20,80] }
(2 + 2 + 4 + 0 coordinates).
The format is similar to SVG, but commands and coordinates are separated. It is comfortable to work with coordinates as a set of 2D points, apply affine transformations etc.
TyprU.glyphsToPath(font, gls)
font
: font objectgls
: the array of glyphs, wich you want to draw using a fontNote, that all paths returned by Typr.U
are in font units ( font.head.unitsPerEm ). You must scale them down to convert them to pixels.
TyprU.pathToContext(path, ctx)
path
: path to drawctx
: context2d to draw the path intoIt executes each command of the path with a corresponding command of context2D: moveTo(), lineTo(), ... It does nothing else (you must do translate(), scale(), fillStyle, fill(), stroke() ... manually).
TyprU.pathToSVG(path)
Converts a path to an "SVG path string", which can be used in <path d="..." />
.
Let's implement a little function for drawing a string:
import { TyprU } from "typr-ts";
class FancyTyprU extends TyprU {
public static stringToContext(font, str, ctx, size, color, x, y) {
let gls = TyprU.stringToGlyphs(font, str);
// gls.reverse(); // reverse if Right-to-Left
let path = TyprU.glyphsToPath (font, gls);
let scale = size / font.head.unitsPerEm;
ctx.translate(x,y); ctx.scale(scale,-scale);
ctx.fillStyle = color;
TyprU.pathToContext(path, ctx);
ctx.fill();
ctx.scale(1 / scale, -1 / scale); ctx.translate(-x, -y);
}
}
There is a "view direction" (left to right) of glyphs, in which they are usually rendered. It may be different than the logical direction of characters in the memory (in which they are written).
TyprU.stringToGlyphs
expects characters to be in the logical direction, while TyprU.glyphsToPath
method expects glyphs to be in the "view direction" (left to right).
If your text contains e.g. only Arabic / Hebrew parts, just reverse the array of glyphs before calling TyprU.glyphsToPath
. When your text contains both RTL and LTR parts, reorder glyphs according to the Unicode BIDI algorithm (e.g. using unicode-bidirectional).
FAQs
Typr.ts - process fonts in TypeScript.
We found that typr-ts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.