Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
postcss-js-core
Advanced tools
postcss-js-core
provides common functionality needed by various css-in-js
custom PostCSS syntaxes.
Many css-in-js syntaxes do much of the same work, with slight variations on what they support and how they work. This module aims to provide the basic building blocks for those situations.
Let's say your syntax makes use of tagged template literals named css
.
You can create your PostCSS syntax like so:
import {
createParser,
createStringifier
} from 'postcss-js-core';
const options = {
id: 'my-syntax',
tagNames: ['css']
};
export = {
parse: createParser(opts),
stringify: createStringifier(opts)
};
If you then use this as a PostCSS/stylelint custom syntax, it will parse the following code:
const foo = css`
div { color: blue; }
`;
When creating a parser/stringifier, you can specify some options. These are as follows:
{
// Required - an identifier for your syntax
id: 'my-syntax',
// Tagged templates to look for
tagNames: ['css'],
// Custom sub-parser
parser: lessSyntax.parse,
// Custom sub-stringifier _class_
stringifier: require('postcss-less/lib/LessStringifier.js')
}
We currently only support CSS in tagged template literals. The tags we consider
as stylesheets are specified by tagNames
in the options object.
Any tagged templates using these names will have their contents treated as CSS and extracted into PostCSS.
Two forms are supported:
['css']
)['css.*']
would match css.foo
, it is not a
RegExp)You may want to support a "syntax within a syntax". For example, LESS sources inside your JavaScript files.
In order to do this, you must pass the syntax's parser and stringifier class in your options.
For example:
createParser({
// ...
parser: require('postcss-less').parse,
stringifer: require('postcss-less/lib/LessStringifier.js')
});
Importantly, you must pass the class of the stringifier rather than the stringify function. This is so we can correctly extend it.
Two common ones are (at time of writing this) located at:
postcss-scss/lib/scss-stringifier.js
postcss-less/lib/LessStringifier.js
FAQs
The core module of various postcss css-in-js syntaxes
We found that postcss-js-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.