
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@csstools/postcss-rebase-url
Advanced tools
npm install @csstools/postcss-rebase-url --save-dev
PostCSS Rebase URL rebases url()
functions when transforming CSS.
When bundling CSS, the location of the final stylesheet file will be different than the individual source files.
PostCSS Rebase URL rewrites the contents of url()
functions so that relative paths continue to work.
Instead of manually mapping where the files will be in the final output you can use this plugin
and simply use the relative paths to each source file.
If you need something with more knobs and dials, please checkout postcss-url
/* when used with a bundler like `postcss-import` */
/* test/examples/example.css */
@import url("imports/basic.css");
/* test/examples/imports/basic.css */
.foo {
background: url('../../images/green.png');
}
/* becomes */
/* test/examples/example.expect.css */
.foo {
background: url("../images/green.png");
}
Add PostCSS Rebase URL to your project:
npm install postcss @csstools/postcss-rebase-url --save-dev
Use it as a PostCSS plugin:
const postcss = require('postcss');
const postcssRebaseURL = require('@csstools/postcss-rebase-url');
postcss([
postcssRebaseURL(/* pluginOptions */)
]).process(YOUR_CSS /*, processOptions */);
FAQs
Rebase url() functions when transforming CSS
The npm package @csstools/postcss-rebase-url receives a total of 1,197 weekly downloads. As such, @csstools/postcss-rebase-url popularity was classified as popular.
We found that @csstools/postcss-rebase-url demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.