Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
fast-sass-loader
Advanced tools
High performance sass loader for webpack 1/2.
Features:
sass-loader
in large sass project@ import
same file in different placeurl(...)
(see https://github.com/webpack-contrib/sass-loader#problems-with-url)fast sass loader for webpack. 5~10 times faster than sass-loader, and support url resolve.
Good News: Now fast-sass-loader
support webpack 2
sass-loader
Features | fast-sass-loader | sass-loader |
---|---|---|
Performance | Fast (5~10 times) | Slow |
Sass Dedupe | ✓ | × |
Url Resolve | ✓ | × (need resolve-url-loader, it's buggy) |
Loader Config | × | ✓ |
Source Map | × | ✓ |
Internal Cache | ✓ | × |
You can execute npm run perf
to see the performance benchmark:
************** RUN WITH FAST SASS LOADER **************
Hash: 37ed419b014ff87f0461
Version: webpack 2.2.1
Time: 7457ms
Asset Size Chunks Chunk Names
dist/index.js 2.67 kB 0 [emitted] index
index.css 627 kB 0 [emitted] [big] index
[0] ./index.scss 41 bytes {0} [built]
[1] ../~/.0.23.1@css-loader/lib/css-base.js 1.51 kB [built]
Child extract-text-webpack-plugin:
[0] ../~/.0.23.1@css-loader/lib/css-base.js 1.51 kB {0} [built]
[1] ../~/.0.23.1@css-loader!../lib!./index.scss 648 kB {0} [built]
[build] fast-sass-loader: 9348.760ms
************** RUN WITH SASS LOADER **************
Hash: 0b034e431d1a93826d38
Version: webpack 2.2.1
Time: 64124ms
Asset Size Chunks Chunk Names
dist/index.js 2.67 kB 0 [emitted] index
index.css 6.95 MB 0 [emitted] [big] index
[0] ./index.scss 41 bytes {0} [built]
[1] ../~/.0.23.1@css-loader/lib/css-base.js 1.51 kB [built]
Child extract-text-webpack-plugin:
[0] ../~/.0.23.1@css-loader/lib/css-base.js 1.51 kB {0} [built]
[1] ../~/.0.23.1@css-loader!../~/.6.0.3@sass-loader/lib/loader.js!./index.scss 7.18 MB {0} [built]
[build] sass-loader: 64892.699ms
Since the sass-loader
doesn't dedupe repeated sass files, the result will be very very large (6.95MB!!!), and the total compile time takes 64.9 seconds (nearly 6 times longer than fast-sass-loader
).
fast-sass-loader
is faster than sass-loader
?node-sass
won't compile same file repeatedly, the performance improvement is s ignificant when your sass files number grows very large.fast-sass-loader
will merge all sass files into a single file, so node-sass only need to compile one large file, it's faster than @importer
of libsass.install by npm:
npm install fast-sass-loader --save-dev
and you need install node-sass and webpack as peer dependencies.
{
module: {
rules: [
{
test: /\.(scss|sass)$/,
use: [
'css-loader',
{
loader: 'fast-sass-loader',
options: {
includePaths: [ ... ]
}
}
]
},
// other loaders ...
]
}
}
{
module: {
loaders: [
{
test: /\.(scss|sass)$/,
loader: 'css!fast-sass'
},
// other loaders ...
]
}
}
.scss
and.sass
file is not allowedSince fast-sass-loader
will parse @import
and merge all files into single sass file, you cannot import .scss
file from .sass
(or opposite).
For example:
// file: entry.scss
@import "path/to/file.sass"; // cannot import `path/to/file.sass` in a `.scss` file
body {
background: #FFF;
}
Since fast-sass-loader
will dedupe sass file, later imported file will be ignored. Using same variable name in different sass fill would produce unexpected output.
For example (compile entry.scss
with fast-sass-loader):
// a.scss
$foobar: #000;
// b.scss
@import "a.scss";
$foobar: #AAA;
h1 { color: $foobar; }
// entry.scss
@import "b.scss";
@import "a.scss"; // this file will be ignore: $foobar === #AAA
// will output:
// h1 { color: #AAA; }
// h2 { color: #AAA; }
h2 { color: $foobar; }
You can use variable prefix to bypass.
MIT
FAQs
fast sass loader for Webpack
The npm package fast-sass-loader receives a total of 31,436 weekly downloads. As such, fast-sass-loader popularity was classified as popular.
We found that fast-sass-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.