@jesscss/plugin-js
Advanced tools
Import bridge for JavaScript/TypeScript modules in stylesheets — a seed of the JavaScript-execution / CSS-in-JS story.
This plugin lets a stylesheet pull in JavaScript/TypeScript modules
(.js, .mjs, .cjs, .ts, .mts, .cts) — the mechanism behind @use /
@-from script imports and legacy Less @plugin loading. When installed, it is
auto-loaded by jess.
plugin-js does not run untrusted module code in your Node process. Before
executing anything, it checks for a usable Deno runtime (deno --version)
and runs the module in a Deno subprocess behind a permission broker:
node_modules (and an optional jsReadRoot),allowHttp, optionally scoped to
allowNetHosts),Values cross the boundary through a small typed bridge (dimensions, colors,
quoted strings, lists, detached rules, …). Built-in @jesscss/fns modules are
trusted and imported directly, without the worker. If no Deno binary is found,
the plugin fails with a clear message instead of falling back to unsandboxed
execution.
One of the four tools Jess aims to converge is
CSS-in-JS: running real JavaScript inside stylesheets so styles can be
dynamic without leaving CSS files. This plugin — together with
@jesscss/plugin-node-modules, which resolves the
packages — is a seed of that story.
That convergence is roadmap — being proven through the alpha, not claimed as
done. Legacy Less @plugin is supported for compatibility but deprecated in
favor of @-from / @-use.
Alpha. Part of Jess. Requires a Deno runtime for script execution. The
programmatic plugin/compiler API is not yet stabilized — the jess CLI is
the documented public surface for the alpha. Watch the
docs site for the API once it settles.
FAQs
Jess plugin for JavaScript/TypeScript module imports with Deno runtime checks
The npm package @jesscss/plugin-js receives a total of 397 weekly downloads. As such, @jesscss/plugin-js popularity was classified as not popular.
We found that @jesscss/plugin-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.
Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.