Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
gulp-cssimport
Advanced tools
Parses a CSS file, finds imports, grabs the content of the linked file and replaces the import statement with it.
Parses a CSS file, finds imports, grabs the content of the linked file and replaces the import statement with it.
npm install gulp-cssimport
var gulp = require("gulp");
var cssimport = require("gulp-cssimport");
var options = {};
gulp.task("import", function() {
gulp.src("src/style.css")
.pipe(cssimport(options))
.pipe(gulp.dest("dist/"));
});
Array, default: []
Additional paths to resolve imports.
Boolean, default: true
gulp-cssimport plugin uses regular expressions which is fast but not solid as AST.
If you have any unexpected result, missing imported content, etc. Try to disable this option.
RegExp, default: null
(no filter).
Process only files which match to regexp.
Any other non-matched lines will be leaved as is.
Example:
var options = {
filter: /^http:\/\//gi // process only http urls
};
String, glob pattern string. See minimatch for more details.
var options = {
matchPattern: "*.css" // process only css
};
var options2 = {
matchPattern: "!*.{less,sass}" // all except less and sass
};
Note:
matchPattern
will not be applied to urls (remote files, e.g. http://fonts.googleapis.com/css?family=Tangerine
), only files.
Urls are matched by default. If you do not want include them, use filter
option (it is applicable to all).
Object, minimatch options for matchPattern
.
Number, default 5000
.
Defence from infinite recursive import.
Function, default null
Transform function applied for each import path.
Signature:
(path: string, data: {match: string}) => string
Arguments:
path
- string, path in import statementmatch
- string, matched import expressionDeprecated, use matchPattern
instead.
String or Array, default: null
(process all).
Case insensitive list of extension allowed to process.
Any other non-matched lines will be leaved as is.
Examples:
var options = {
extensions: ["css"] // process only css
};
var options = {
extensions: ["!less", "!sass"] // all except less and sass
};
Be more precise and do not add to src importing file without necessary:
// main.css
@import "a.css";
@import "b.css";
If you will do gulp.src("*.css")
gulp will read a.css
and b.css
,
and plugin also will try to read these files. It is extra job.
Do instead: gulp.src("main.css")
Use filter option:
If you need exclude files from import, try use filter
only option (it is faster) and avoid others.
There are plugins for PostCSS which do same job or even better:
@import
ruleshttps://npmjs.org/package/gulp-coimport/
https://npmjs.org/package/gulp-concat-css/
https://github.com/yuguo/gulp-import-css/
https://github.com/postcss/postcss-import
https://www.npmjs.com/package/combine-css/
https://github.com/suisho/gulp-cssjoin
https://github.com/jfromaniello/css-import
https://github.com/mariocasciaro/gulp-concat-css
@import 'foo.css' (min-width: 25em);
See CHANGELOG
FAQs
Parses a CSS file, finds imports, grabs the content of the linked file and replaces the import statement with it.
We found that gulp-cssimport demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.