
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@gofunky/cssauron
Advanced tools
build a matching function in CSS for any nested object structure without eval
build a matching function in CSS for any nested object structure without eval
From version v2.0.0, cssauron will only support ES6 modules.
In order to import cssauron with NodeJS versions prior v12, you may use esm.
import cssauron from '@gofunky/cssauron'
const language = cssauron({
tag: 'tagName',
contents: 'innerText',
id: 'id',
class: 'className',
parent: 'parentNode',
children: 'childNodes',
attr: 'getAttribute(attr)'
})
const selector = language('body > #header .logo')
const element = document.getElementsByClassName('logo')[0]
if(selector(element)) {
// element matches selector
} else {
// element does not match selector
}
import { CSSAuron } from '@gofunky/cssauron'
const language = new CSSAuron({})
const selector = language.parse('body > #header .logo')
options are an object hash of lookup type to string attribute or function(node) lookups for queried
nodes. You only need to provide the configuration necessary for the selectors you're planning on creating.
(If you're not going to use #id lookups, there's no need to provide the id lookup in your options.)
tag: Extract tag information from a node for div style selectors.contents: Extract text information from a node, for :contains(xxx) selectors.id: Extract id for #my_sweet_id selectors.class: .class_nameparent: Used to traverse up from the current node, for composite selectors body #wrapper, body > #wrapper.children: Used to traverse from a parent to its children for sibling selectors div + span, a ~ p.attr: Used to extract attribute information, for [attr=thing] style selectors.language('some selector') -> match functionCompiles a matching function.
match(node) -> false | node | [subjects, ...]Returns false if the provided node does not match the selector.
Returns true if the provided node does match.
The exact return value is determined by the selector, based on the
CSS4 subject selector spec:
If only a single node matches, only this node is returned.
If multiple subjects match, a deduplicated array of those subjects is returned.
For example, given the following HTML:
<div id="gary-busey">
<p>
<span class="jake-busey">
</span>
</p>
</div>
Checking the following selectors against the span.jake-busey element yield:
#gary-busey: false, no match.#gary-busey *: span.jake-busey, a single match.!#gary-busey *: div#gary-busey, a single match using the ! subject selector.#gary-busey *, p span: span.jake-busey, a single match, though both selectors match.#gary-busey !* !*, !p > !span: [p, span.jake-busey], two matches.:first-child:last-child:nth-child:empty:root:contains(text):any(selector, selector, selector)[attr=value]: Exact match[attr]: Attribute exists and is not false-y.[attr$=value]: Attribute ends with value[attr^=value]: Attribute starts with value[attr*=value]: Attribute contains value[attr~=value]: Attribute, split by whitespace, contains value.[attr|=value]: Attribute, split by -, contains value.FAQs
build a matching function in CSS for any nested object structure without eval
We found that @gofunky/cssauron demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.