
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
postcss-less
Advanced tools
A PostCSS Syntax for parsing LESS
Note: This module requires Node v6.14.4+. poscss-less is not a LESS compiler. For compiling LESS, please use the official toolset for LESS.
Using npm:
npm install postcss-less --save-dev
Please consider becoming a patron if you find this module useful.
The most common use of postcss-less is for applying PostCSS transformations directly to LESS source. eg. ia theme written in LESS which uses Autoprefixer to add appropriate vendor prefixes.
const syntax = require('postcss-less');
postcss(plugins)
.process(lessText, { syntax: syntax })
.then(function (result) {
result.content // LESS with transformations
});
@importParsing of LESS-specific @import statements and options are supported.
@import (option) 'file.less';
The AST will contain an AtRule node with:
import: true propertyfilename: <String> property containing the imported filenameoptions: <String> property containing any import options specifiedParsing of single-line comments in CSS is supported.
:root {
// Main theme color
--color: red;
}
The AST will contain a Comment node with an inline: true property.
Parsing of LESS mixins is supported.
.my-mixin {
color: black;
}
The AST will contain an AtRule node with a mixin: true property.
!importantMixins that declare !important will contain an important: true property on their respective node.
Parsing of LESS variables is supported.
@link-color: #428bca;
The AST will contain an AtRule node with a variable: true property.
Note: LESS variables are strictly parsed - a colon (:) must immediately follow a variable name.
To process LESS code without PostCSS transformations, custom stringifier should be provided.
const postcss = require('postcss');
const syntax = require('postcss-less');
const less = `
// inline comment
.container {
.mixin-1();
.mixin-2;
.mixin-3 (@width: 100px) {
width: @width;
}
}
.rotation(@deg:5deg){
.transform(rotate(@deg));
}
`;
const result = await postcss().process(less, { syntax });
// will contain the value of `less`
const { content } = result;
This package is similar to postcss-less but is designed to work with SCSS syntax. It allows you to use PostCSS plugins with SCSS files.
Similar to postcss-less, postcss-sass enables you to parse SASS syntax with PostCSS. It is another syntax plugin for PostCSS that targets SASS files instead of LESS.
This package is a PostCSS syntax for parsing Stylus. Like postcss-less, it allows you to use PostCSS plugins with Stylus files, providing similar functionality for a different preprocessor language.
FAQs
LESS parser for PostCSS
The npm package postcss-less receives a total of 1,090,288 weekly downloads. As such, postcss-less popularity was classified as popular.
We found that postcss-less demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.