
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@sylphx/babel-plugin-silk
Advanced tools
Zero-runtime Babel plugin for Silk CSS-in-TypeScript
Compiles css() calls to static class names at build-time, achieving true zero-runtime overhead.
npm install --save-dev @sylphx/babel-plugin-silk
# or
bun add --dev @sylphx/babel-plugin-silk
{
"plugins": ["@sylphx/babel-plugin-silk"]
}
{
"plugins": [
[
"@sylphx/babel-plugin-silk",
{
"production": true,
"classPrefix": "",
"importSources": ["@sylphx/silk"]
}
]
]
}
// Input
import { css } from '@sylphx/silk'
const button = css({ bg: 'red', p: 4 })
// Output (Development)
const button = 'silk_bg_red_a7f3 silk_p_4_b2e1'
// Output (Production - optimal compression)
const button = 'ka5tyn p2rk1o'
// Generated CSS (Development)
.silk_bg_red_a7f3 { background-color: red; }
.silk_p_4_b2e1 { padding: 1rem; }
// Generated CSS (Production - minified)
.ka5tyn{background-color:red}.p2rk1o{padding:1rem}
// Input
const button = css({ bg: props.color, p: 4 })
// Output
const button = css({ bg: props.color }, 'silk_p_4_b2e1')
// Generated CSS
.silk_p_4_b2e1 { padding: 1rem; }
Static properties are extracted at build-time, dynamic properties remain at runtime.
| Option | Type | Default | Description |
|---|---|---|---|
production | boolean | false | Enable production optimizations (6-7 char hashes) |
classPrefix | string | 'silk' (dev), none (prod) | Class name prefix for branding |
importSources | string[] | ['@sylphx/silk'] | Import sources to transform |
functions | string[] | ['css'] | Function names to transform |
In production mode, class names are optimized for minimal file size using Base-36 hashes:
// No prefix (optimal compression: 6-7 chars)
{ production: true }
// Output: .hgv0lpf, .yfr0d6, .ka5tyn
// Custom prefix (branding support)
{ production: true, classPrefix: 'app' }
// Output: .apphgv0lpf, .appyfr0d6, .appka5tyn
CSS Identifier Compliance: Leading digits (0-9) are automatically mapped to letters (g-p) to ensure valid CSS identifiers. This maintains optimal compression while guaranteeing 100% browser compatibility.
// vite.config.ts
import { defineConfig } from 'vite'
import { transformSync } from '@babel/core'
import babelPluginSilk from '@sylphx/babel-plugin-silk'
export default defineConfig({
plugins: [
{
name: 'vite-plugin-silk',
transform(code, id) {
if (!id.endsWith('.tsx') && !id.endsWith('.ts')) return null
const result = transformSync(code, {
filename: id,
plugins: [babelPluginSilk],
})
// Extract CSS from metadata
const css = result?.metadata?.silk?.cssRules
.map(([_, rule]) => rule)
.join('\n')
return {
code: result?.code,
map: result?.map,
}
},
},
],
})
// next.config.js
module.exports = {
experimental: {
swcPlugins: [
['@sylphx/babel-plugin-silk', { production: true }]
]
}
}
// webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.(ts|tsx)$/,
use: {
loader: 'babel-loader',
options: {
plugins: ['@sylphx/babel-plugin-silk']
}
}
}
]
}
}
The plugin emits metadata via result.metadata.silk:
interface SilkMetadata {
cssRules: Array<[className: string, cssRule: string]>
classNames: string[]
version: string
}
const result = transformSync(code, {
plugins: [babelPluginSilk]
})
// Access generated CSS
const css = result.metadata.silk.cssRules
.map(([_, rule]) => rule)
.join('\n')
// Write to file
fs.writeFileSync('output.css', css)
bg, p, m, etc.)p: 4 → 1rem)_hover, _focus){ base: '100%', md: '50%' })css() calls from configured import sourcescss)# Build
bun run build
# Test
bun test
# Watch mode
bun run dev
MIT © SylphX Ltd
FAQs
Babel plugin for zero-runtime Silk CSS-in-TypeScript compilation
We found that @sylphx/babel-plugin-silk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.