Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Inspired by TomDoc, KSS attempts to provide a methodology for writing maintainable, documented CSS within a team. Specifically, KSS is a documentation specification and styleguide format. It is not a preprocessor, CSS framework, naming convention, or specificity guideline.
The methodology and ideas behind Knyle Style Sheets are contained in SPEC.md. At its core, KSS is a documenting syntax for CSS.
/*
A button suitable for giving stars to someone.
:hover - Subtle hover highlight.
.stars-given - A highlight indicating you've already given a star.
.stars-given:hover - Subtle hover highlight on top of stars-given styling.
.disabled - Dims the button to indicate it cannot be used.
Styleguide 2.1.3.
*/
a.button.star{
...
}
a.button.star.stars-given{
...
}
a.button.star.disabled{
...
}
KSS can also support words as Styleguide section names
// Styleguide Forms.Checkboxes.
// - or -
// Styleguide Forms - Special Checkboxes.
This repository includes a ruby library suitable for parsing SASS, SCSS, and CSS documented with KSS guidelines. To use the library, include it in your project as a gem from https://rubygems.org/gems/kss. Then, create a parser and explore your KSS.
styleguide = Kss::Parser.new("#{RACK_ROOT}public/stylesheets")
styleguide.section('2.1.1')
# => <Kss::Section>
styleguide.section('2.1.1').description
# => "A button suitable for giving stars to someone."
styleguide.section('2.1.1').modifiers.first
# => <Kss::Modifier>
styleguide.section('2.1.1').modifiers.first.name
# => ':hover'
styleguide.section('2.1.1').modifiers.first.class_name
# => 'pseudo-class-hover'
styleguide.section('2.1.1').modifiers.first.description
# => 'Subtle hover highlight'
You can also initialize the Kss::Parser
with a string CSS by using Kss::Parser.new(string)
buttons =<<-'EOS'
/*
Your standard form button.
:hover - Highlights when hovering.
:disabled - Dims the button when disabled.
Styleguide 1.1
*/
button {
padding: 5px 15px;
line-height: normal;
/* ... */
}
button:disabled {
opacity: 0.5;
}
EOS
styleguide = Kss::Parser.new(buttons)
styleguide.section('1.1')
# => <Kss::Section>
styleguide.section('1.1.1').description
# => "Your standard form button."
# ...
The library is also fully TomDoc'd, completing the circle of life.
The documenting syntax and ruby library are intended to generate styleguides automatically. To do this, you'll need to leverage a small javascript library that generates class styles for pseudo-class styles (:hover
, :disabled
, etc).
For an example of how to generate a styleguide, check out the example
sinatra application.
To hack on KSS, you'll need to install dependencies with bundle install
. Run tests with rake
.
To make your life easier, I suggest bundle install --binstubs
and adding bin/
to your $PATH
. If you don't understand this, just blindly add bundle exec
in front of everything you'd normally do, like bundle exec rake
.
I apologize on behalf of the Ruby community for this, it's embarrassing and disappointing that dependency management is still so clumsy.
The KSS specification has also been implemented in Python, Node.js and PHP
FAQs
Unknown package
We found that kss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.