
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
css-variable-lsp
Advanced tools
A Language Server Protocol (LSP) implementation focused on CSS custom properties (variables). It indexes variables across your workspace and provides completions, hover resolution, and diagnostics.
var( in CSS files, HTML <style> blocks/style="" attributes, and JS/TS string literals, with relevance scoring..css, .scss, .sass, .less, plus HTML <style> blocks and inline styles.!important, specificity, and source order.var(--name).var(--...) usages.npm install
npm run compile
# via local build
node out/server.js --stdio
# or, if installed from npm
css-variable-lsp --stdio
This is a standalone LSP server. Configure it in any LSP client.
Command-line flags:
--no-color-preview--color-only-variables (show colors only on var(--...) usages)--lookup-files "<glob>,<glob>" (comma-separated list of glob patterns)--lookup-file "<glob>" (repeatable)--ignore-globs "<glob>,<glob>" (comma-separated list of glob patterns)--ignore-glob "<glob>" (repeatable)--path-display=relative|absolute|abbreviated--path-display-length=N (only used for abbreviated; 0 disables shortening)--undefined-var-fallback=warning|info|off (controls diagnostics for undefined vars when a var() fallback exists)Environment variables:
CSS_LSP_COLOR_ONLY_VARIABLES=1 (same as --color-only-variables)CSS_LSP_LOOKUP_FILES (comma-separated glob patterns; ignored if CLI lookup flags are provided)CSS_LSP_IGNORE_GLOBS (comma-separated glob patterns; ignored if CLI ignore flags are provided)CSS_LSP_DEBUG=1 (enable debug logging)CSS_LSP_PATH_DISPLAY=relative|absolute|abbreviatedCSS_LSP_PATH_DISPLAY_LENGTH=1 (same as --path-display-length)CSS_LSP_UNDEFINED_VAR_FALLBACK=warning|info|offDefaults:
--path-display: relative--path-display-length: 1--undefined-var-fallback: warning**/*.css**/*.scss**/*.sass**/*.less**/*.html**/*.vue**/*.svelte**/*.astro**/*.ripple**/node_modules/****/dist/****/out/****/.git/**abbreviated mode shortens each directory segment (except the final one) to the configured length, matching fish-style prompt shortening. Lookup/ignore globs accept standard glob patterns (including brace expansions like **/*.{css,scss}). Ignore globs replace the defaults when provided (include any defaults you still want to keep).
Assume a variable is defined in /Users/you/project/src/styles/theme.css and your workspace root is /Users/you/project.
--path-display=relative (default):
Defined in src/styles/theme.css--path-display=absolute:
Defined in /Users/you/project/src/styles/theme.css--path-display=abbreviated --path-display-length=1:
Defined in s/s/theme.css--path-display=abbreviated --path-display-length=2:
Defined in sr/st/theme.css--path-display=abbreviated --path-display-length=0 (no shortening):
Defined in src/styles/theme.cssHover and color resolution use CSS cascade rules (specificity, !important, source order) but do not model DOM nesting or selector combinators. See LIMITATIONS.md for details.
src/ TypeScript sourceout/ compiled server (npm bin entry)LIMITATIONS.md known limitationsnpm test
FAQs
A CSS Language Server for CSS Variables
We found that css-variable-lsp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.