
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@style.tools/async-css-iife
Advanced tools
Node.js IIFE generator for Async CSS Loader. Module and CLI program.
This repository contains a Node.js IIFE generator for async-css (async CSS loader).
IIFE (Immediately-invoked Function Expressions) is a coding pattern for loading a script. An IIFE can be used in the browser safely.
The advantage of using an IIFE is that it adds a Google Closure Compiler optimization layer over the concatenated modules which improves the compression.
The IIFE generator is a simple Node.js program that can be used as a Node.js module or that can be executed as a CLI program from the command-line.
npm install @style.tools/async-css-iife
You can use the generator from the command-line (CLI, SSH, shell) or as a Node.js module (e.g. in a Express app).
The provided iife-cli.js script can be used from the command-line. For easy usage, the NPM package contains a pre-configured npm run iife script. To use the NPM CLI command you need to navigate to the module directory:
cd node_modules/@style.tools/async-css-iife/
Display usage information and a list with available modules.
npm run iife -- --help

The following command shows how to create an IIFE with unary format, output to path/to/iife.js and with 3 modules that automatically load the required dependencies.
npm run iife -- --format unary --compress --output path/to/iife.js --modules css-loader,localstorage,timing
You can also use short flags as shown in the following example that includes debug sources and a space-separated module list instead of a comma separated list.
npm run iife -- -f unary -c -o path/to/iife.js -m "css-loader localstorage timing"
When omitting the --output flag, the script is printed so you could use > output.js.
// load Node.js module
const iife = require('@style.tools/async-css-iife');
// return script text for inlining
// uses memory-cache @link https://www.npmjs.com/package/memory-cache
iife.generate(['css-loader', 'timing'], {
debug: true, // debug sources
format: 'unary' // !function(){ ... }()
}).then(function(iife_script) {
// iife_script contains the IIFE script text
});
// output to file
iife.generate(['css-loader', 'timing'], {
compress: true, // Google Closure Compiler API compression
format: 'wrap', // (function(){ ... })()
output: 'path/to/iife.js',
output_stats: true // return { modules:[], size:0, gzip_size:0 }
}).then(function(stats) {
// iife.js written
console.log(stats);
});
The Node.js IIFE generator is optmized for integration in a Node.js CMS however it depends on the free Google Closure Compiler API that may not be 100% reliable. When using the generator in production it may be best to use a local Google Closure Compiler service.
Generated IIFE's are cached in memory using memory-cache so that you can use the solution for real-time inlining, for example in a Express.js app.
An IIFE needs to be generated just once and remains valid until the Node.js app restarts (memory reset), when the module selection or settings are changed or until the async-css vesion is upgraded.
For a PHP solution, see the php-cms-connector PHP Composer library.
FAQs
Node.js IIFE generator for Async CSS Loader. Module and CLI program.
We found that @style.tools/async-css-iife demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.