
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@chess99/typed-less-modules
Advanced tools
Generate TypeScript definitions (.d.ts) files for CSS Modules that are written in LESS (.less).
typed-less-modules 用于将 .less 转换为对应的 .d.ts TypeScript 类型声明文件。

For example, given the following LESS:
@import "variables";
.text {
color: @blue;
&-highlighted {
color: @yellow;
}
}
The following type definitions will be generated:
export const text: string;
export const textHighlighted: string;
Run with npm package runner:
npx tlm src
Or, install globally:
yarn global add typed-less-modules
tlm src
Or, install and run as a devDependency:
yarn add -D typed-less-modules
yarn tlm src
For all possible commands, run tlm --help.
The only required argument is the directory where all LESS files are located (config.pattern). Running tlm src will search for all files matching src/**/*.less. This can be overridden by providing a glob pattern instead of a directory. For example, tlm src/*.less
--watch (-w)booleanfalsetlm src --watchWatch for files that get added or are changed and generate the corresponding type definitions.
--ignoreInitialbooleanfalsetlm src --watch --ignoreInitialSkips the initial build when passing the watch flag. Use this when running concurrently with another watch, but the initial build should happen first. You would run without watch first, then start off the concurrent runs after.
--ignorestring[][]tlm src --watch --ignore "**/secret.less"A pattern or an array of glob patterns to exclude files that match and avoid generating type definitions.
--includePaths (-i)string[][]tlm src --includePaths src/coreAn array of paths to look in to attempt to resolve your @import declarations. This example will search the src/core directory when resolving imports.
--aliases (-a)object{}tlm src --aliases.~some-alias src/core/variablesAn object of aliases to map to their corresponding paths. This example will replace any @import '~alias' with @import 'src/core/variables'.
--nameFormat (-n)"camel" | "kebab" | "param" | "dashes" | "none""camel"tlm src --nameFormat camelThe class naming format to use when converting the classes to type definitions.
App-Logo => appLogo.App-Logo => app-logo (all lower case with '-' separators).App => App, App-Logo => appLogo. Matches the webpack css-loader camelCase 'dashesOnly' option.--exportType default when using --nameFormat none as any classes with a - in them are invalid as normal variable names).
Note: If you are using create-react-app v2.x and have NOT ejected, --nameFormat none --exportType default matches the class names that are generated in CRA's webpack's config.--listDifferent (-l)booleanfalsetlm src --listDifferentList any type definition files that are different than those that would be generated. If any are different, exit with a status code 1.
--exportType (-e)"named" | "default""named"tlm src --exportType defaultThe export type to use when generating type definitions.
namedGiven the following LESS:
.text {
color: blue;
&-highlighted {
color: yellow;
}
}
The following type definitions will be generated:
export const text: string;
export const textHighlighted: string;
defaultGiven the following LESS:
.text {
color: blue;
&-highlighted {
color: yellow;
}
}
The following type definitions will be generated:
export type Styles = {
text: string;
textHighlighted: string;
};
export type ClassNames = keyof Styles;
declare const styles: Styles;
export default styles;
This export type is useful when using kebab (param) cased class names since variables with a - are not valid variables and will produce invalid types or when a class name is a TypeScript keyword (eg: while or delete). Additionally, the Styles and ClassNames types are exported which can be useful for properly typing variables, functions, etc. when working with dynamic class names.
--exportTypeNamestring"ClassNames"tlm src --exportType default --exportTypeName ClassesTypeCustomize the type name exported in the generated file when --exportType is set to "default".
Only default exports are affected by this command. This example will change the export type line to:
export type ClassesType = keyof Styles;
--exportTypeInterfacestring"Styles"tlm src --exportType default --exportTypeInterface IStylesCustomize the interface name exported in the generated file when --exportType is set to "default".
Only default exports are affected by this command. This example will change the export interface line to:
export type IStyles = {
// ...
};
--quoteType (-q)"single" | "double""single"tlm src --exportType default --quoteType doubleSpecify a quote type to match your TypeScript configuration. Only default exports are affected by this command. This example will wrap class names with double quotes (").
--logLevel (-l)"verbose" | "error" | "info" | "silent""verbose"tlm src --logLevel errorSets verbosity level of console output.
--config (-c)stringtlm.config.jstlm --config ./path/to/tlm.config.js指定配置文件的路径,配置文件可代替所有的命令行参数,默认读取 process.cwd() + tlm.config.js 文件。
// tlm.config.js
const path = require("path");
module.exports = {
pattern: "./src/**/*.m.less",
watch: true,
// ...
// 上述所有配置均可用
aliases: {
// 映射至多路径
"~": [
path.resolve(__dirname, "node_modules"),
path.resolve(__dirname, "src")
],
// 映射至单路径
"@": path.resolve(__dirname, "some-dir"),
// 自定义映射规则
"abc-module"(filePath) {
return filePath.replace("abc-module", "xxx-path");
}
},
// less.render options 参数
lessRenderOptions: {
javascriptEnabled: true
}
};
verbosePrint all messages
errorPrint only errors
infoPrint only some messages
silentPrint nothing
For examples, see the examples directory:
This package was forked from typed-scss-modules.
This package is currently used as a CLI. There are also packages that generate types as a webpack loader.
FAQs
TypeScript type definition generator for LESS CSS Modules
The npm package @chess99/typed-less-modules receives a total of 0 weekly downloads. As such, @chess99/typed-less-modules popularity was classified as not popular.
We found that @chess99/typed-less-modules demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.