
Research
/Security News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
postcss-values-parser
Advanced tools
A CSS property value parser for use with PostCSS, following the same node, container, and traversal patterns as PostCSS.
As with PostCSS and postcss-selector-parser, this parser generates an Abstract Syntax Tree, (aka "AST") which allows for ease of traversal and granular inspection of each part of a property's value.
Yeah, it's a tad confusing. The Lesshint project needed a parser that would allow detailed inspection of property values to the same degree that PostCSS and postcss-selector-parser provided. This was especailly important for the Lesshint project, as it provides for very granular rules for linting LESS.
postcss-value-parser makes a lot of assumption about how values should be parsed and how the resulting AST should be organized. It was also fairly out of sync with the tokenzing and traversal patterns and convenience methods found in PostCSS and postcss-selector-parser.
So we needed an alternative, and drew upon all three projects to put together a value parser that met and exceeded our needs. The improvements include:
Please see the API Documentation for full usage information.
As with any NPM module, start with the install:
npm install postcss-values-parser
Using this parser is straightforward and doesn't require callbacks:
// ES6
let parser = require('postcss-values-parser');
let ast = parser('#fff').parse();
let color = ast // the Root node
.first // the Value node
.first; // a Word node, containing the color value.
// ES5
var parser = require('postcss-values-parser');
var ast = parser('#fff').parse();
var color = ast // the Root node
.first // the Value node
.first; // a Word node, containing the color value.
This project was heavily influenced by postcss-selector-parser and utilized many patterns and logical constructs from the project.
Tests and some tokenizing techniques found in postcss-value-parser and were used.
css-tree is a CSS parser that produces an AST for CSS documents. It offers similar functionality for parsing CSS but is more focused on entire stylesheets rather than individual values. Compared to postcss-values-parser, css-tree provides a broader scope of CSS parsing capabilities.
css-what is a package for parsing CSS selectors. It provides functionality to parse selector strings into an understandable format but does not focus on CSS properties or values. While it offers parsing capabilities, its focus is different from that of postcss-values-parser, which is more centered on CSS values.
FAQs
A CSS property value parser for use with PostCSS
The npm package postcss-values-parser receives a total of 5,219,381 weekly downloads. As such, postcss-values-parser popularity was classified as popular.
We found that postcss-values-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Research
/Security News
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Product
Stay on top of alert changes with filtered subscriptions, batched summaries, and notification routing built for triage.