Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@joblift/babel-plugin-transform-postcss
Advanced tools
This is a fork from https://github.com/wbyoung/babel-plugin-transform-postcss, which seems currently unmaintained. Why? We needed to update dependencies and include the latest unpublished fixes from that library. Fork updates include:
Thanks to the original authors. Have fun.
A Babel plugin to process CSS files via PostCSS.
Using PostCSS Modules, it can transform:
import styles from "./styles";
.example {
color: cyan;
}
Into an object that has properties mirroring the style names:
var styles = { example: "_example_amfqe_1" };
Install the transform as well as postcss
and any PostCSS plugins you want to
use:
# using yarn
yarn add -D @joblift/babel-plugin-transform-postcss
# using npm
npm install --save-dev @joblift/babel-plugin-transform-postcss
Add the transform to your babel configuration, i.e. .babelrc
:
{
"presets": [["env", { "targets": { "node": "current" } }]],
"plugins": ["transform-postcss"]
}
Create a postcss.config.js
:
module.exports = (ctx) => ({
plugins: [
require("postcss-modules")({
getJSON: ctx.extractModules || (() => {}),
}),
],
});
You can also specify a location to load your postcss.config.js
from in the options in your Babel configuration, i.e. .babelrc
:
{
"plugins": [
[
"transform-postcss",
{
"config": "configuration/postcss.config.js"
}
]
]
}
By default we look for .css
files, but you can also specify the extensions we should look for:
{
"plugins": [
[
"transform-postcss",
{
"config": "configuration/postcss.config.js",
"extensions": [".scss"]
}
]
]
}
The transform will transform all imports & require statements that have a .css
extension and run them through postcss
. To determine the PostCSS config, it
uses postcss-load-config
with
additional context values. One of those config
values, extractModules
should be
invoked in order to define the value of the resulting import.
No CSS is actually included in the resulting JavaScript. It is expected that you
transform your CSS using the same postcss.config.js
file as the one used by
this transform. We recommend:
postcss-cli
(v3 or later)gulp-postcsssrc
Finally, it's worth noting that this transform also adds a comment to the
generated code indicating the related CSS file so that it can be processed by
other tools, i.e. relateify
.
extractModules(_: any, modules: object)
This option is a function that may be passed directly on to
postcss-modules
as the getJSON
argument. Other uses, while unlikely, are
permittable, as well.
The function accepts two arguments. The transform uses only the
second value passed to the function. That value is the object value that
replaces the import
/require
.
This will work well with the babelify
transform, but if you're
using watchify
, you will want to add the relateify
transform in order to ensure that changes to CSS files rebuild the appropriate
JS files.
This module caches the results of the compilation of CSS files and stores the
cache in a directory under /tmp/bptp-UNIQUE_ID
. The cache is only invalidated
when the CSS file contents change and not when the postcss.config.js
file
changes (due to limitations at the time of implementation). Try removing the
cache if you're not seeing expected changes.
This plugin is based of the work of:
Unlike the above, it supports both synchronous and asynchronous PostCSS plugins.
This project is distributed under the MIT license.
FAQs
PostCSS Babel Transform
We found that @joblift/babel-plugin-transform-postcss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.