
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@jesscss/core
Advanced tools
The Jess compiler engine: the AST, evaluator, and single-pass serializer that turn a parsed stylesheet into CSS.
@jesscss/core is the engine at the heart of
Jess. It defines the syntax tree that every Jess parser produces,
evaluates that tree (resolving variables, expanding mixins, running functions,
applying extend, and folding nesting), and renders the result to CSS.
The AST lives here rather than in the jess package so that parsers can depend on
the tree without pulling in the compiler, and jess can depend on the parsers
plus core — avoiding a circular dependency.
Rules, declarations, selectors, values, …) that
make up a parsed stylesheet, shared by every language grammar.@jesscss/plugin-less, @jesscss/plugin-scss) and compatibility layers wire
into.This is an internal engine package. Most people should install
rather than depending on @jesscss/core directly. Most people should install
jess and use the jess CLI
rather than depending on @jesscss/core directly. Its JavaScript/TypeScript API
is not yet stabilized and is intentionally undocumented for now.
Alpha. Jess renders real .less today and is being dogfooded against the Less
test suite and Bootstrap, but it is early software with known rendering gaps.
Published to npm under both the latest and alpha dist-tags. Please
report bugs.
FAQs
The Jess Core Library
The npm package @jesscss/core receives a total of 784 weekly downloads. As such, @jesscss/core popularity was classified as not popular.
We found that @jesscss/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.