
Security News
Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
@jesscss/core
Advanced tools
The Jess compiler engine: the AST, evaluator, and single-pass serializer that turn a parsed stylesheet into CSS.
@jesscss/core is the engine at the heart of
Jess. It defines the syntax tree that every Jess parser produces,
evaluates that tree (resolving variables, expanding mixins, running functions,
applying extend, and folding nesting), and renders the result to CSS.
The AST lives here rather than in the jess package so that parsers can depend on
the tree without pulling in the compiler, and jess can depend on the parsers
plus core — avoiding a circular dependency.
Rules, declarations, selectors, values, …) that
make up a parsed stylesheet, shared by every language grammar.@jesscss/plugin-less, @jesscss/plugin-scss) and compatibility layers wire
into.This is an internal engine package. Most people should install
rather than depending on @jesscss/core directly. Most people should install
jess and use the jess CLI
rather than depending on @jesscss/core directly. Its JavaScript/TypeScript API
is not yet stabilized and is intentionally undocumented for now.
Alpha. Jess renders real .less today and is being dogfooded against the Less
test suite and Bootstrap, but it is early software with known rendering gaps.
Published to npm under both the latest and alpha dist-tags. Please
report bugs.
FAQs
The Jess Core Library
The npm package @jesscss/core receives a total of 143 weekly downloads. As such, @jesscss/core popularity was classified as not popular.
We found that @jesscss/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.