
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
Transform your Figma designs into production-ready React components with Tailwind CSS automatically.
VibeFigma can be used in multiple ways:
For Claude Code, install the skill to enable Figma to React conversion directly within your Claude Code environment.
npx npx skills add vibeflowing-inc/vibe_figma --skill vibefigma
npx vibefigma --interactive
The CLI will guide you through:
npx vibefigma "https://www.figma.com/design/4i8Tp5btFPRqtkYXplnfT6/50-Web-Sign-up-log-in-designs--Community-?node-id=26-2944&t=d8ZfhZOwcLuUz0Jz-4" --token YOUR_TOKEN
Set your Figma token once:
export FIGMA_TOKEN=your_figma_access_token
npx vibefigma "https://www.figma.com/design/4i8Tp5btFPRqtkYXplnfT6/50-Web-Sign-up-log-in-designs--Community-?node-id=26-2944&t=d8ZfhZOwcLuUz0Jz-4"
.env file or pass via --token flag# Convert a Figma design to React component
npx vibefigma "https://www.figma.com/design/4i8Tp5btFPRqtkYXplnfT6/50-Web-Sign-up-log-in-designs--Community-?node-id=26-2944&t=d8ZfhZOwcLuUz0Jz-4"
# Save to specific directory
npx vibefigma [url] -c ./src/components -a ./public/assets
# Save to specific file
npx vibefigma [url] -c ./src/components/Hero.tsx
# Generate regular CSS instead of Tailwind
npx vibefigma [url] --no-tailwind
npx vibefigma [url] \
--token YOUR_TOKEN \
--component ./src/components \
--assets ./public/assets \
--optimize \
--clean
Usage: vibefigma [options] [url]
Convert Figma designs to React components
Arguments:
url Figma file/node URL
Options:
-V, --version Output the version number
-t, --token <token> Figma access token (overrides FIGMA_TOKEN env var)
-u, --url <url> Figma file/node URL
-c, --component <path> Component output path (default: ./src/components/[ComponentName].tsx)
-a, --assets <dir> Assets directory (default: ./public)
--no-tailwind Disable Tailwind CSS (enabled by default)
--optimize Optimize components
--clean Use AI code cleaner (requires GOOGLE_GENERATIVE_AI_API_KEY)
--no-classes Don't generate CSS classes
--no-absolute Don't use absolute positioning
--no-responsive Disable responsive design
--no-fonts Don't include fonts
--interactive Force interactive mode
-h, --help Display help for command
This project also includes a REST API server:
# Install dependencies
bun install
# Run development server
bun run dev
# Server runs on http://localhost:3000
Create a .env file:
GOOGLE_GENERATIVE_AI_API_KEY=your_google_ai_key
PORT=3000
HOST=0.0.0.0
CORS_ORIGIN=*
The project includes a REST API for Figma to React conversion:
POST /v1/api/vibe-figma
See API.md for full API documentation.
# Run CLI in development mode
bun run dev:cli
# Build CLI
bun run build:cli
# Test CLI locally
bun run cli -- --help
Contributions are welcome! Please feel free to submit a Pull Request.
This project includes code derived from css-to-tailwindcss by Salakhutdinov Salavat, licensed under the MIT License.
This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). See the LICENSE file for the full license text.
See the NOTICE file for details about third-party code used in this project.
FAQs
Convert Figma designs to React components with Tailwind CSS
We found that vibefigma demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.