Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
postcss-global-import
Advanced tools
npm install --save postcss-global-import
Having files foo.css:
.foo {
color: green;
}
@media (min-width: 640px) {
.foo {
color: red
}
}
And local.css:
@global-import "./foo.css";
/* Some Css */
We will get:
:global .foo {
color: green;
}
@media (min-width: 640px) {
:global .foo {
color: red
}
}
/* Some Css */
In case of sync enabled this plugin will be work synchronously. It's useful in case with usage
css-modules-require-hook
hook, which doesn't support async postcss plugins.
By default, postcss-global-import
do nothing with keyframe names,
because there is no way to escape animation name in animation-name
or animation
properties
for plugin postcss-modules-local-by-default
which currently using as dependency postcss-modules plugin.
So, in other words, if you are using postcss-modules or
postcss-modules-local-by-default plugins and
turn on globalizeKeyframes
option, following css would
be not imported properly:
@keyframes myCoolAnimation {
}
.foo {
animation: myCoolAnimation;
}
And animation property value myCoolAnimation
will be renamed but keyframe name not:
@keyframes myCoolAnimation {
}
.foo {
animation: _myCoolAnimation__7zliz_1;
}
Turn this option on only if you want import keyframes itself and there are no usage of these keyframes in imported file. In this case postcss-global-import plugin turns
@keyframes myCoolAnimation {
}
into
@keyframes :global(myCoolAnimation) {
}
This semantic for keyframe names is supported by postcss-modules-local-by-default. There is new postcss-icss-keyframes plugin (which is coming to replace postcss-modules-local-by-default along with postcss-icss-selectors) which currently doesn't support any mechanics for escaping keyframe names from renaming. PRs for both postcss-icss-keyframes and postcss-global-import are welcome.
Basically only thing you should do is include this plugin to plugin list inside your postcss.config.js
file and configure any postcss loader for your css files.
FAQs
Post Css plugin for global import css.
We found that postcss-global-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.