Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
backpack.css
Advanced tools
A lightweight and somewhat opinionated CSS foundation that is best suited to applications 🎒.
A lightweight and somewhat opinionated CSS foundation that is best suited to applications.
Run the following command using npm:
npm install backpack.css --save-dev
If you prefer Yarn, use this command instead:
yarn add backpack.css --dev
backpack.css is pretty easy to use. The one strict rule is that it must come before your project's CSS to ensure correct ordering of your styles and to be able to override any of backpack.css styles.
import 'backpack.css';
import '[path(s)-to-your-project-css]';
If you're using webpack, then use the tilde (~
) prefix at the start of the path, e.g.:
@import '~backpack.css';
@import '[path(s)-to-your-project-css]';
Link to backpack.css using a <link>
element in your HTML Head, e.g.:
<head>
[…]
<link rel="stylesheet" href="https://unpkg.com/backpack.css" />
<link rel="stylesheet" href="[path-to-your-project-css]" />
</head>
backpack.css is just CSS so you can easily override any of its styles just as you would override any CSS, as in, via the rules of the cascade and specificity.
For example, if you don't want to use the global system font-stack defined by sanitize.css then override it in your project CSS like so:
html {
font-family: serif;
}
Nowadays, I'm building React applications that have highly componentised User Interfaces (UI) making use of native CSS layout mechanisms such as Flexbox and Grid. I'm no longer finding the need for heavy-handed CSS frameworks that handle most of my UI concerns, especially layout and utilities. Instead, I build components with a smidgen of global styles.
What I do need, however, are a bunch of smart and sensible foundational styles suited for applications that I would typically forget project to project—think sanitize.css and then some. Something lightweight, super easy to integrate, and can easily be overridden or allow for modular use, thus giving birth to backpack.css 🙂🎒.
border-box
value for the box-sizing
property to all elements.And more…
All of the CSS is very well documented if you want to dig deeper.
As mentioned above, backpack.css applies sensible OpenType features. However, due to the poor support of the font-variant-
properties, backpack.css has to declare their equivalents via the better supported, but harder to maintain, font-feature-settings
property (the font-feature-settings
properties should always come first).
Here are some resources on this:
backpack.css uses Browserslist to manage its browser support.
backpack.css does not support IE. To see the Browserslist queries backpack.css uses, see the .browserslistrc
file.
Browserslist is used for Autoprefixer. Autoprefixer only adds a tiny amount of vendor prefixes, the main properties being prefixed are:
font-feature-settings
font-variant-ligatures
This doesn't mean that backpack.css cannot be used in browsers outside of the above Browserslist query, just that compatibility is ensured with the ones within the query.
Please see our Contributing Guidelines.
backpack.css is maintained under the Semantic Versioning guidelines. We'll do our best to adhere to those guidelines and strive to maintain backwards compatibility.
See the Changelog.
And anyone else who's been so kind to share their work out in the open.
❤️ Open source.
The code is available under the MIT license.
FAQs
A lightweight and somewhat opinionated CSS foundation that is best suited to applications 🎒.
The npm package backpack.css receives a total of 900 weekly downloads. As such, backpack.css popularity was classified as not popular.
We found that backpack.css demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.