
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
kremling-loader
Advanced tools
[](https://www.npmjs.org/package/kremling-loader)
The Kremling webpack loader is an abstraction
on top of the awesome Postcss project.
It allows you to process your css the way you'd like, and then it passes formatted data
to the <Scoped> component.
NPM:
$ npm install -D kremling-loader
Yarn:
$ yarn add -D kremling-loader
// webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.css$/,
use: [
{
loader: 'kremling-loader',
options: {
namespace: 'custom-namespace',
postcss: {},
},
},
],
},
],
}
}
| property | type | default | description |
|---|---|---|---|
namespace | string | kremling-id | Customize the scoped namespace (helpful if you have multiple apps running kremling at the same time). <Scoped> Note: Passing a name through the namespace prop is not necessary when using the this loader option. |
postcss | object | null | Pass-through options for postcss - all postcss options are accepted here |
Since the postcss property is a straight pass through for postcss options, we can add any plugin
we want into it.
autoprefixer plugin.cssnano plugin.precss plugin.Chaining loaders allows you to take advantage of more powerful tools like SCSS or LESS before
passing css to the kremling-loader:
// webpack.config.js
...
{
test: /\.scss$/,
use: ['kremling-loader', 'sass-loader' ]
}
...
This loader requires the input to be a plain string resource, so if you use something like the
css-loader (which converts css to a CommonJS module), you'll need to use the extract-loader before
passing it to kremling-loader:
// webpack.config.js
...
{
test: /\.scss$/,
use: ['kremling-loader', 'extract-loader', 'css-loader' ]
}
...
First, write your css:
/* style.css */
.container {
background-color: red;
}
We then import our styles into our component file, and pass it to the useCss hook:
import React from 'react';
import css from './style.css';
export default function Foo(props) {
const scope = useCss(css);
return <div {...scope} className="container"></div>
}
Alternatively, for class components:
import React, { Component } from 'react';
import css from './style.css';
export default class Foo extends Component {
render() {
return (
<Scoped postcss={css}>
<div className="container">Hello World!</div>
</Scoped>
);
}
}
kremling scopingkremling css by default is global, and it requires you to opt-in to scoping by
prepending an ampersand (&) symbol at the beginning of each rule:
const css = `
.global {
background-color: blue;
}
& .scoped {
background-color: red;
}
`;
kremling-loader scopingFunny enough, kremling-loader is the exact opposite 🥴. Since the loader
intelligently adds scoping without ampersands, by default, the css is always
scoped. You have to opt-out of scoping by prepending a :global pseudo
class at the beginning of your rule:
// scoped
.scoped {
background-color: blue;
}
// global
:global .global {
background-color: red;
}
FAQs
[](https://www.npmjs.org/package/kremling-loader)
The npm package kremling-loader receives a total of 666 weekly downloads. As such, kremling-loader popularity was classified as not popular.
We found that kremling-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.