
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@diskette/vex
Advanced tools
Compiles vanilla-extract .css.ts files into CSS, JS, and TypeScript declarations
Compiles vanilla-extract .css.ts files into CSS, JavaScript, and TypeScript declarations.
npm install @diskette/vex
# or
pnpm add @diskette/vex
Peer dependency: Requires @vanilla-extract/css
npm install @vanilla-extract/css
vex <patterns...> [options]
# Process all .css.ts files in src/ and output to dist/
vex "src"
# Use a custom output directory
vex "src" --output build
# Preview what would be processed without writing files
vex "src" --dry-run
# Watch for changes and recompile
vex "src" --watch
# Use a specific tsconfig
vex "src" --tsconfig tsconfig.build.json
# Combine options
vex "src/components" -o dist/css -n
| Option | Alias | Description | Default |
|---|---|---|---|
--output <dir> | -o | Directory for compiled CSS, JS, and .d.ts output | dist |
--namespace <name> | Namespace for CSS scoping | * | |
--tsconfig <path> | -p | Path to tsconfig.json for TypeScript resolution | |
--dry-run | -n | Process files without writing output | |
--watch | -w | Watch for file changes and recompile | |
--quiet | -q | Suppress non-error output | |
--debug | -d | Show configuration and matched files before processing |
* Defaults to name in package.json, or the current directory name
For each .css.ts source file, Vex generates three files:
.css - Compiled CSS.js - JavaScript module with exported class names and style references.d.ts - TypeScript declarationsvex "src" -o dist
src/ dist/
├── components/ ├── components/
│ ├── button.css.ts → │ ├── button.css
│ │ │ ├── button.js
│ │ │ ├── button.d.ts
│ │ │ │
│ └── card.css.ts → │ ├── card.css
│ │ ├── card.js
│ │ └── card.d.ts
│ │
└── theme.css.ts → ├── theme.css
├── theme.js
└── theme.d.ts
import { Vex } from '@diskette/vex'
const vex = new Vex({
namespace: 'my-app',
compilerOptions: { outDir: 'dist' },
})
vex.addSource('src/styles.css.ts')
// Full build with async iteration
for await (const event of vex.build()) {
switch (event.type) {
case 'transpile':
console.log(`Transpiling: ${event.file.path}`)
break
case 'complete':
// event.result.outputs.css, .js, .dts
break
case 'done':
console.log(`Built ${event.results.length} files in ${event.totalDuration}ms`)
break
}
}
// Or compile a single file
const result = vex.compile('src/styles.css.ts')
// result.outputs.css, result.outputs.js, result.outputs.dts
.css from collected styles, .js with serialized exports, and .d.ts declarationsMIT
FAQs
Compiles vanilla-extract .css.ts files into CSS, JS, and TypeScript declarations
We found that @diskette/vex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.