
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
rollup-plugin-css-only
Advanced tools
# v4 is compatible with Rollup 4 & 3 & 2
# Rollup 4 since v4.4
npm install --save-dev rollup-plugin-css-only
// rollup.config.js
import css from 'rollup-plugin-css-only'
export default {
input: 'input.js',
output: {
file: 'output.js',
format: 'es',
assetFileNames: 'assets/[name]-[hash][extname]'
},
plugins: [css()]
}
// entry.js
import './reset.css'
import './layout.css'
/* layout.css */
@import './nested.css';
@import './more.css';
By default the plugin will use output.assetFileNames to decide the filename.
css({
exclude, // [optional] - Array of glob/Strings like what `include` uses.
fileName, // [optional] - File name of emitted asset.
include, // [optional] - Array of glob/Strings - default: ['**/*.css'].
name, // [optional] - Name of the emitted asset.
output, // [optional] - Below are the possible values for `output`:
// ---------------------------------------------------------------------------
// Filename to write all styles to
output: 'bundle.css',
// Callback that will be called on generate with two arguments:
// - styles: the contents of all style tags combined: 'body { color: green }'
// - styleNodes: an array of style objects: [{ lang: 'css', content: 'body { color: green }' }]
output: (styles, styleNodes) => {
writeFileSync('bundle.css', styles)
},
// Disable any style output or callbacks
output: false,
// Default behaviour is to write all styles to the bundle destination where .js is replaced by .css
output: null
})
Please see CHANGELOG for more information what has changed recently.
Contributions and feedback are very welcome.
To get it running:
npm installnpm run buildThe MIT License (MIT). Please see License File for more information.
FAQs
Rollup plugin that bundles imported css
The npm package rollup-plugin-css-only receives a total of 19,757 weekly downloads. As such, rollup-plugin-css-only popularity was classified as popular.
We found that rollup-plugin-css-only demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.