
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
astros-css-sprite
Advanced tools
自动合并雪碧图
该中间件简化了雪碧图合并。使用图片时,按目录存放在 root/img/sprite 下,在CSS中正常引用单张图片,发布时,该中间件会自动按目录合并雪碧图,并替换CSS中的图片引用。
###开发中
图片路径
root/img/sprite/button/loading.png
root/img/sprite/button/cancel.png
CSS中引用
.btn-loading{
background-image:url(/img/sprite/button/loading.png);
}
.btn-cancel{
background-image:url(/img/sprite/button/calcel.png);
}
###发布后
图片路径
root/img/sprite_button.png
CSS中引用
.btn-loading{
background:url(~/img/sprite_button.png) no-repeat 0 0;
background-size: 100% 100%;
}
.btn-loading{
background:url(~/img/sprite_button.png) no-repeat 100px 100px;
background-size: 100% 100%;
}
FAQs
We found that astros-css-sprite demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.