
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@jesscss/fns
Advanced tools
The built-in Less/Sass style-function library — color, math, string, and list helpers, split per-file for tree-shaking.
@jesscss/fns is the standard function library for
Jess. It provides the built-in functions the language exposes:
color operations (lighten, darken, mix, saturate, …), math (round,
floor, sqrt, pow, …), unit and type helpers, string helpers, and list/map
utilities.
Functions live in their own files and are re-exported from a dialect index, so bundlers can tree-shake down to only the helpers you actually use.
Each dialect owns its globals. A dialect folder's index exports what lives
in that folder plus the entries of shared/ that dialect actually has, and that
index is simultaneously the importable module and the unit the compiler
registers. There is no merged built-in set and no fallback from one dialect to
another — a Sass function is never served the Less implementation.
@jesscss/fns → dialect namespaces (`less`, `sass`, `shared`) + registry helpers
@jesscss/fns/less → the Less dialect index (the Less built-in set)
@jesscss/fns/less/registry→ `makeLessRegistry()`
@jesscss/fns/sass → the Sass dialect index (Sass globals)
@jesscss/fns/sass/registry→ `makeSassRegistry()`
@jesscss/fns/sass/color → sass:color
@jesscss/fns/sass/list → sass:list
@jesscss/fns/sass/map → sass:map
@jesscss/fns/sass/math → sass:math
@jesscss/fns/sass/string → sass:string
@jesscss/fns/shared → functions whose behaviour is identical in Less and Sass
@jesscss/fns/registry → `fnsOf(index)` / `registryOf(index)`
Adding a built-in is a new module in the dialect folder plus one line in that folder's index. Nothing else enumerates the set.
Entries that are still in the legacy tree-node domain remain exported for the JavaScript-callable surface but are not registered as built-ins; converting one in place is what registers it.
The Sass-side helpers exist in the source tree as part of the roadmap Sass+ work, but SCSS is not the focus of the Less-focused alpha — treat that surface as experimental.
This is an internal engine package. The functions are primarily invoked by the
compiler during evaluation, and several expect a Jess evaluation context on
this — they are not yet a general-purpose, standalone JavaScript API. Most
people should install jess and use the
jess CLI. The JavaScript/TypeScript API is not yet stabilized.
Alpha. Published to npm under both the latest and alpha dist-tags. Please
report bugs.
FAQs
Jess functions module
The npm package @jesscss/fns receives a total of 646 weekly downloads. As such, @jesscss/fns popularity was classified as not popular.
We found that @jesscss/fns demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.