
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
This middleware was created to allow processing of Less files for Connect JS framework and by extension the Express JS framework.
This package was forked from emberfeather/less.js-middleware to use Less v2.5.x.
npm install less-mw --save
lessMiddleware(source, [{options}])
var lessMiddleware = require('less-mw');
var app = express();
app.use(lessMiddleware(__dirname + '/public'));
app.use(express.static(__dirname + '/public'));
optionsThe following options can be used to control the behavior of the middleware:
| Option | Description | Default |
|---|---|---|
debug | Show more verbose logging? | false |
dest | Destination directory to output the compiled .css files. | Same directory as less source files. |
force | Always re-compile less files on each request. | false |
once | Only recompile once after each server restart. Useful for reducing disk i/o on production. | false |
pathRoot | Common root of the source and destination. It is prepended to both the source and destination before being used. | null |
postprocess | Object containing functions relevant to preprocessing data. | |
postprocess.css | Function that modifies the compiled css output before being stored. | function(css, req){...} |
preprocess | Object containing functions relevant to preprocessing data. | |
preprocess.less | Function that modifies the raw less output before being parsed and compiled. | function(src, req){...} |
preprocess.path | Function that modifies the less pathname before being loaded from the filesystem. | function(pathname, req){...} |
preprocess.importPaths | Function that modifies the import paths used by the less parser per request. | function(paths, req){...} |
render | Options for the less render. See the "render Options" section below. | … |
storeCss | Function that is in charge of storing the css in the filesystem. | function(pathname, css, req, next){...} |
cacheFile | Path to a JSON file that will be used to cache less data across server restarts. This can greatly speed up initial load time after a server restart - if the less files haven't changed and the css files still exist, specifying this option will mean that the less files don't need to be recompiled after a server restart. |
render OptionsThe options.render is passed directly into the less.render with minimal defaults or changes by the middleware.
The following are the defaults used by the middleware:
| Option | Default |
|---|---|
compress | auto |
yuicompress | false |
paths | [] |
Common examples of using the Less middleware are available in the wiki.
{force: true}!Make sure you're declaring less-mw before your static middleware, if you're using the same directory, e.g. (with express):
var lessMiddleware = require('less-mw');
var app = express();
app.use(lessMiddleware(__dirname + '/public'));
app.use(express.static(__dirname + '/public'));
not
var lessMiddleware = require('less-mw');
var app = express();
app.use(express.static(__dirname + '/public'));
app.use(lessMiddleware(__dirname + '/public'));
If you are hosting your app on IIS you will have to modify your web.config file in order to allow NodeJS to serve your CSS static files. IIS will cache your CSS files, bypassing NodeJS static file serving, which in turn does not allow the middleware to recompile your LESS files.
FAQs
LESS.js middleware for connect.
We found that less-mw demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.