
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
purgecss-cli
Advanced tools
CLI to remove unused CSS (TypeScript, cosmiconfig, interactive prompts, watch, minify, reports)
Remove unused CSS from your project with a fast CommonJS CLI.
Zero‑config via cosmiconfig, smart Tailwind extraction, minify, watch, reports, and friendly interactive prompts (only when --content / --css are missing).
package.json, .purgecss-clirc.*, purgecss-cli.config.*content & css only if missing)--minify)--watch)--report)--backup) of originals--rejected → *.rejected.txt)# local dev dependency
npm i -D purgecss-cli
# or global for quick use
npm i -g purgecss-cli
# If your config already defines content/css, this just runs:
npx purgecss-cli
# Or pass globs explicitly:
npx purgecss-cli \
-c "src/**/*.{html,js,jsx,ts,tsx,vue,svelte,md,mdx}" \
-s "dist/**/*.css" \
--tailwind --minify --rejected
If --content or --css are missing, the CLI will prompt for them.
purgecss-cli loads config from any of these (first match wins):
package.json → "purgecss-cli": { ... }.purgecss-clirc / .purgecss-clirc.{json,yaml,yml,js,cjs}purgecss-cli.config.{js,cjs,json,yaml,yml}{
"content": ["src/**/*.{html,js,jsx,ts,tsx,vue,svelte,md,mdx}"],
"css": ["dist/**/*.css"],
"tailwind": true,
"minify": true,
"rejected": true,
"safelist": ["modal-open", "prose"],
"safelistPatterns": ["^btn-", "^(enter|leave)-"],
"out": "pruned/",
"report": "reports/prune.json"
}
CLI flags override values from config.
# Initialize a sample config file in the current directory
npx purgecss-cli --init
# Basic run (no prompts if config covers it)
npx purgecss-cli
# Explicit globs + Tailwind extractor + minify
npx purgecss-cli -c "src/**/*.{html,tsx}" -s "dist/**/*.css" --tailwind --minify
# Output to a different folder (keeps filenames)
npx purgecss-cli -c "src/**/*.{html,tsx}" -s "dist/**/*.css" -o pruned/
# Keep certain classes always
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --safelist modal-open prose
# Keep classes by regex (e.g., keep all btn-* and text-*)
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --safelist-patterns "^btn-" "^text-"
# Inspect removed selectors (writes .rejected.txt next to outputs)
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --rejected
# JSON report with size savings per file
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --report reports/run.json
# Watch for changes and re-run automatically
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --watch
# Dry run: calculate savings without writing files
npx purgecss-cli -c "src/**/*" -s "dist/**/*.css" --dry-run
--tailwind (or tailwind: true in config).md:hover:underline and arbitrary values like w-[37%].className={"btn-" + size}) aren’t visible to static analysis—use safelist:
--safelist btn-sm btn-lg--safelist-patterns "^btn-"--safelist modal-open prose--safelist-patterns "^toast-" "^(enter|leave)-"{ "safelist": ["modal-open"], "safelistPatterns": ["^btn-"] }
-o pruned/.--backup → saves *.bak.--rejected) → writes filename.css.rejected.txt.--report path.json) includes per‑file before/after/saved bytes and rejected counts.npx purgecss-cli -c "app/**/*.{tsx,html}" -s ".next/static/css/*.css" --tailwind --watch
Watches both content & CSS globs. On change, re‑runs pruning (debounced).
Add to package.json:
{
"scripts": {
"prune:css": "purgecss-cli --minify --rejected --report reports/prune.json"
}
}
Then:
npm run prune:css
Use in CI after your build step, before packaging artifacts.
ESM‑only dependency error (e.g., chalk, cosmiconfig, ora)
chalk@4, cosmiconfig@8, ora@5.Classes missing after prune
Safelist dynamic/conditionally built classes via --safelist / --safelist-patterns. Check the *.rejected.txt file to see what got removed.
No files matched
Wrap globs in quotes so your shell doesn’t expand them early:
-c "src/**/*.{html,tsx}" -s "dist/**/*.css"
Tailwind JIT
Point content globs at your source files (where class names live), not just compiled HTML.
| Flag | Type | Description |
|---|---|---|
-c, --content | string[] | Required globs of files to scan (HTML/JS/TS/MD/MDX/Vue/Svelte, etc.) |
-s, --css | string[] | Required CSS file globs to prune |
-o, --out | string | Output directory (default overwrites in place) |
--tailwind | boolean | Enable Tailwind‑aware extraction |
--safelist | string[] | Always keep these class/selector names |
--safelist-patterns | string[] (regex) | Regex keep rules (e.g., ^btn-) |
--rejected | boolean | Write *.rejected.txt with removed selectors |
--dry-run | boolean | Don’t write files; just show stats |
--minify | boolean | Minify output CSS using CSSO |
--backup | boolean | Create *.bak next to original (in‑place only) |
--watch | boolean | Re‑run on changes to content/CSS |
--report | string | Write a JSON report with per‑file stats |
--config | string | Explicit path to config file |
--init | boolean | Create purgecss-cli.config.json scaffold |
--verbose | boolean | Extra logging |
FAQs
CLI to remove unused CSS (TypeScript, cosmiconfig, interactive prompts, watch, minify, reports)
The npm package purgecss-cli receives a total of 3 weekly downloads. As such, purgecss-cli popularity was classified as not popular.
We found that purgecss-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.