Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A CSS minifier for PostCSS
For readability, almost all CSS file contains a lot of white spaces, extra semicolon, etc.:
.foo {
width: 100px;
}
.bar {
margin-top: 0px;
}
.baz {
color: rgb(255, 0, 0);
background-color: rgb(36, 36, 36);
}
This PostCSS plugin removes and converts these non-essential parts of CSS file, like this:
.foo{width:100px}.bar{margin-top:0}.baz{color:red;background-color:#242424}
$ npm install csswring
Of course, this package can be used as PostCSS plugin:
"use strict";
var fs = require("fs");
var postcss = require("postcss");
var css = fs.readFileSync("test.css", "utf8");
postcss([
require("autoprefixer")(),
require("csswring")()
]).process(css).then(function (result) {
fs.writeFileSync("test.min.css", result.css);
});
To minify test.css
to test.min.css
:
#!/usr/bin/env node
"use strict";
var fs = require("fs");
var csswring = require("csswring");
var css = fs.readFileSync("test.css", "utf8");
fs.writeFileSync("test.min.css", csswring.wring(css).css);
This package also installs a command line interface.
$ node ./node_modules/.bin/csswring --help
Usage: csswring [options] INPUT [OUTPUT]
Description:
Minify CSS using PostCSS
Options:
--sourcemap Create source map file.
--preserve-hacks Preserve some CSS hacks.
--remove-all-comments Remove all comments.
-h, --help Show this message.
--version Print version information.
Use a single dash for INPUT to read CSS from standard input.
Examples:
$ csswring foo.css
$ csswring foo.css > foo.min.css
$ cat foo.css bar.css baz.css | csswring - > fbb.min.css
When PostCSS failed to parse INPUT, CLI shows a CSS parse error in GNU error format instead of Node.js stack trace.
CSSWring doesn’t remove only white spaces or comments, but also remove an unnecessary parts of CSS. See minification details in our GitHub Wiki.
By default, CSSWring removes all unknown portion of CSS declaration that
includes some CSS hacks (e.g., underscore hacks and star hacks). If you want to
preserve these hacks, pass preserveHacks: true
to this module.
postcss([
csswring({
preserveHacks: true
})
]).wring(css);
By default, CSSWring keeps a comment that start with /*!
. If you want to
remove all comments, pass removeAllComments: true
to this module.
postcss([
csswring({
removeAllComments: true
})
]).wring(css);
Wring css
with specified options
.
The second argument is optional. The options
is same as the second argument of
PostCSS’s process()
method. This is useful for generating source map.
var fs = require("fs");
var csswring = require("csswring");
var css = fs.readFileSync("from.css", "utf8");
var result = csswring.wring(css, {
map: {
inline: false
},
from: "from.css",
to: "to.css"
});
fs.writeFileSync("to.css", result.css);
fs.writeFileSync("to.css.map", result.map);
See also Source Map section in PostCSS document for more about this
options
.
You can also merge CSSWring options mentioned above to the second argument:
var result = csswring.wring(css, {
map: true,
preserveHacks: true
});
FAQs
A CSS minifier for PostCSS
The npm package csswring receives a total of 6,544 weekly downloads. As such, csswring popularity was classified as popular.
We found that csswring demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.