
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
quark-loader
Advanced tools
Loader for webpack to process CSS files to minimize and compress as much as possible.

Webpack to deduplicate, minify and compress CSS as much as possible.To begin you'll need to install quark-loader
npm install --save-dev quark-loader
Add the loader to your webpack config.
file.js
import file from 'file.js';
Chain the quark-loader with css-loader and the style-loader to immediately minimize and apply all styles to the DOM.
webpack.config.js
module.exports = {
module: {
rules: [
{
test: /\.css$/,
use: [
{
loader: 'style-loader'
},
{
loader: 'css-loader',
options: {
modules: true,
localIdentName: '[hash:base64:3]',
importLoaders: 3,
},
},
{
loader: 'quark-loader',
options: {
compress: true,
},
},
],
},
],
},
};
You can also use the quark-loader with sass-loader. For example
module: {
rules: [
{
test: /\.scss$/,
use: [
{
loader: 'style-loader'
},
{
loader: 'css-loader',
options: {
modules: true,
localIdentName: '[hash:base64:3]',
importLoaders: 3,
},
},
{
loader: 'quark-loader',
options: {
compress: true,
},
},
{
loader: 'sass-loader',
},
],
},
],
},
quark-loader process the CSS files and replaced our style with a reference to our declarations. In this way, we can remove repetitive styles from our CSS and make it minimum.

style.css
.a {
top: 100px;
}
.b {
top: 100px;
}
.c {
top: 100px;
}
.d {
top: 100px;
}
Let's review what we get at the end
Extracted CSS file
.t7E {
top: 100px;
}
.BOO {
}
._1dA {
}
._1rC {
}
._3e1 {
}
Without CSS extraction
exports.locals = {
"top--100px": "t7E",
"a": "BOO t7E",
"b": "_1dA t7E",
"c": "_1rC t7E",
"d": "_3e1 t7E"
};
FAQs
Loader for webpack to process CSS files to minimize and compress as much as possible.
We found that quark-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.