
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
styled-prose
Advanced tools
Generate images and thumbnails based on bitmap transformations of rendered prose.
Documentation: https://styledprose.thearchitector.dev.
Tested support on Python 3.8, 3.9, 3.10, 3.11, and 3.12.
$ pdm add styled-prose
# or
$ pip install --user styled-prose
The following stylesheet is a super simple example that overrides the default style's font size and family.
# stylesheet.toml
[[fonts]]
font_name = "EB Garamond"
from_google_fonts = true
[[styles]]
name = "default"
font_size = 14
font_name = "EB Garamond"
Using that stylesheet, and some basic prose, you can generate an image. The requested font family EB Garamond and its license are downloaded from Google Fonts and cached automatically; subsequent generations use those cached fonts.
from PIL import Image
from styled_prose import StyledProseGenerator
text: str = """
This is normal.
<i>This is italicized.</i>
<b>This is bold.</b>
<i><b>This is bold and italicized.</b></i>
<u>This is underlined.</u>
<strike>This is struck from the record.</strike>
"""
random.seed(771999)
generator: StyledProseGenerator = StyledProseGenerator("stylesheet.toml")
img: Image.Image = generator.create_jpg(
text,
angle=-2.5, # optional; an angle by which to rotate the image
thumbnail=(210, 210), # optional; the dimensions of a random thumbnail
)
img.save("prose.jpg", quality=95)
This above code produces the following image:

FAQs
Generate images and thumbnails based on bitmap transformations of rendered prose
We found that styled-prose demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.