Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
<style>
tag8kb
totalnpm install afro
let domify = require('domify')
let Afro = require('..')
let container = Afro(`
@font-face {
font-family: 'Open Sans';
font-style: normal;
font-weight: 400;
src: local('Open Sans'), local('OpenSans'), url(https://fonts.gstatic.com/s/opensans/v13/cJZKeOuBrn4kERxqtaUH3ZBw1xU1rKptJj_0jans920.woff2) format('woff2');
}
.red {
font-family: 'Open Sans';
background: red;
}
`)
let span = Afro(`
.blue {
font-family: 'Open Sans';
background: blue;
}
@media (min-width: 33em) {
.blue {
background: turquoise;
}
}
`)
let css = Afro(container, span)
document.body.appendChild(domify(`
<div class="${css.red}">
<span class="${css.blue}">hi there!</span>
<span class="${css.blue}">hi there!</span>
</div>
`)
// Or if you want to generate a static string and not inject
document.body.appendChild(domify(`
<style type="text/css" afro static>${css}</style>
<div class="${css.red}">
<span class="${css.blue}">hi there!</span>
<span class="${css.blue}">hi there!</span>
</div>
`)
Afro is a spiritual successor to Aphrodite. Aphrodite uses JSON as the way to write CSS, where Afro you just write plain CSS.
Aphrodite also uses global singletons on the server-side to generate CSS which prevents you from doing any sort of concurrency.
Aphrodite doesn't yet support parent > child relationships like this one parent:hover child { ... }
. With Afro that relationship just works.
Lastly, Aphrodite writes CSS dynamically as you need it in your components. Afro inserts all the CSS (deduped) at once, making the model quite a bit simpler. There may be some benefits to dynamically inserted CSS, like less work to do on initialization, but there are definitely a few caveats.
CSS modules introduce new syntax into CSS via composes
and require a build system like postcss or webpack to make it work.
Right now the autoprefixing library uses inline style names which are camel-cased. We could skip this step entirely if we had an autoprefixer library that could deal with hyphened properties.
<style>
injection feature creep?Good observation! This is something I was planning to exclude from this library. The reason it's important to inject a style tag is that allows your modules to work standalone.
You can require a module and run that code and it will just work without any style-specific initialization on your end. With that being said, it's good practice to export your styles alongside your component so you can compose the styles together.
If you're building an app and you have control over the styles, you'll want to compose all the styles together to get the benefits of de-duped CSS.
You also may want to ignore the injection all together and just render the CSS to a string and stick it in a React <style>
element
npm install
make test
Logo is from Oliviu Stoian.
MIT
FAQs
refined aphrodite
The npm package afro receives a total of 3 weekly downloads. As such, afro popularity was classified as not popular.
We found that afro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.