
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
build a matching function in CSS for any nested object structure!
var language = require('cssauron')({
tag: 'tagName'
, contents: 'innerText'
, id: 'id'
, class: 'className'
, parent: 'parentNode'
, children: 'childNodes'
, attr: 'getAttribute(attr)'
})
var selector = language('body > #header .logo')
, element = document.getElementsByClassName('logo')[0]
if(selector(element)) {
// element matches selector
} else {
// element does not match selector
}
It's easy to use with your favorite nested tree structures! Delicious with HTML! Digestable with JSON!
| HTML | JSON | GLSL AST | JS AST (Esprima) |
|---|---|---|---|
| cssauron-html | cssauron-json | cssauron-glsl | cssauron-falafel |
Import cssauron and configure it for the nested object structure you'll
want to match against.
options are an object hash of lookup type to string attribute or function(node) lookups for queried
nodes. You only need to provide the configuration necessary for the selectors you're planning on creating.
(If you're not going to use #id lookups, there's no need to provide the id lookup in your options.)
tag: Extract tag information from a node for div style selectors.contents: Extract text information from a node, for :contains(xxx) selectors.id: Extract id for #my_sweet_id selectors.class: .class_nameparent: Used to traverse up from the current node, for composite selectors body #wrapper, body > #wrapper.children: Used to traverse from a parent to its children for sibling selectors div + span, a ~ p.attr: Used to extract attribute information, for [attr=thing] style selectors.Compiles a matching function.
Returns false if the provided node does not match the selector. Returns truthy if the provided node does match. Exact return value is determined by the selector, based on the CSS4 subject selector spec: if only a single node is matched, only that node is returned. If multiple subjects are matched, a deduplicated array of those subjects are returned.
For example, given the following HTML (and cssauron-html):
<div id="gary-busey">
<p>
<span class="jake-busey">
</span>
</p>
</div>
Checking the following selectors against the span.jake-busey element yields:
#gary-busey: false, no match.#gary-busey *: span.jake-busey, a single match.!#gary-busey *: div#gary-busey, a single match using the ! subject selector.#gary-busey *, p span: span.jake-busey, a single match, though both selectors match.#gary-busey !* !*, !p > !span: [p, span.jake-busey], two matches.:first-child:last-child:nth-child:empty:root:contains(text):any(selector, selector, selector)[attr=value]: Exact match[attr]: Attribute exists and is not false-y.[attr$=value]: Attribute ends with value[attr^=value]: Attribute starts with value[attr*=value]: Attribute contains value[attr~=value]: Attribute, split by whitespace, contains value.[attr|=value]: Attribute, split by -, contains value.css-select is a library for selecting elements in a DOM-like structure using CSS selectors. It is commonly used with Cheerio to query HTML documents. Unlike cssauron, which is designed for custom JavaScript objects, css-select is specifically tailored for HTML and XML documents.
Sizzle is a pure-JavaScript CSS selector engine designed to be easily dropped in to a host library. It is the selector engine used by jQuery. Sizzle is focused on querying DOM elements, whereas cssauron is more flexible and can be used to query any JavaScript object.
json-query allows querying JSON data structures using a simple query language. It is similar to cssauron in that it can be used to query custom data structures, but it uses a different syntax and approach for defining queries.
FAQs
create matching selectors from css for your very own nested object hierarchy
The npm package cssauron receives a total of 465,277 weekly downloads. As such, cssauron popularity was classified as popular.
We found that cssauron demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.