
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A micro css preprocessor written in JS for JS. Under 100 lines. Supports nesting, mixins, parent selectors, and injectable values. Also comes with a tiny color manipulation utility.
npm install pico-css
const css = require('pico-css');
const {lighten} = require('pico-css/chroma.js');
const btn = (color)=>{
return css`
cursor : pointer;
background-color: ${color};
&:hover{
background-color: ${lighten(color, 0.2)};
}
`
}
css`
body{
margin-top : 20px;
button{
font-size : 2em;
${btn('#dabb1e')}
}
}
`;
// Converts to -->
`body{
margin-top: 20px;
}
body button{
font-size: 2em;
cursor: pointer;
background-color: #dabb1e;
}
body button:hover{
background-color: #e1c84b;
}
`
CSS preprocessors like Less and Sass, are very powerful, but require you to learn a new sub-language and any business logic would need to be duplicated between rendering and styling.
They also provide way more features then is typically needed, and can lead to weird footguns and overly designed style systems. pico-css is just a simple lib for convert nested css into valid css while leveraging JS for variables and logic.
pico-css also ships with a little color manipulation utility called chroma. Docs here.
const css = require('pico-css');
const {lighten, isDark, fade} = require('pico-css/chroma');
//Adaptive text color to ensure high contrast for readability
const textColor = (color)=>isDark(color) ? 'white' : 'black';
const btnColor = 'blue';
css`
button{
color : ${textColor(btnColor)};
background-color: ${btnColor}
&:hover{
background-color: ${lighten(btnColor, 0.2)};
}
}`
pico-css comes with most of the useful features of css pre-processor with none of the bloat.
You can nest rules within rules
css`
body{
p{
color : black;
}
}
`
//-->
`body p {
color : black;
}`
The & operator represents the parent selectors of a nested rule and is most commonly used when applying a modifying class or pseudo-class to an existing selector.
css`
p{
&:hover{ color : blue; }
&.selected{ color : red; }
}`;
//-->
`p:hover{
color : blue;
}
p.selected{
color : red;
}`
You can pass just rules to the parser and it will process them. This allows you to build mixins which can be used to copy repeated css, or create functions that return chunks of css.
const btn = (color)=>{
return css`
cursor : pointer;
background-color: ${color};
&:hover{
background-color: ${lighten(color, 0.2)};
}
`
}
css`
body{
margin-top : 20px;
button{
font-size : 2em;
${btn('#dabb1e')}
}
}
`;
Supports both block comments /* */ and single line comments //
css\style`` -> CSS StringThe most common way to use pico-css is to use it as a tagged template literal. This will convert the template string and return valid a CSS string. You'll still need to save it, bundle it, or package it in some way, all pico-css cares about is parsing your styling.
const css = require('pico-css');
const {lighten} = require('pico-css/chroma.js');
const btn = (color)=>{
return css`
cursor : pointer;
background-color: ${color};
&:hover{
background-color: ${lighten(color, 0.2)};
}
`
}
css`
body{
margin-top : 20px;
button{
font-size : 2em;
${btn('#dabb1e')}
}
}
`;
css.inject(styleObj) / css.inject\style` -> Style TagConverts and then creates a new <style> tag and injects it into the web document's head. Only works client side. Useufl for prototyping and experimenting.
const css = require('pico-css');
css.inject`
body{
background-color : red;
}
`
FAQs
A tiny css preprocessor using javascript
We found that pico-css demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.