
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@jesscss/plugin-less-compat
Advanced tools
A Less compatibility bridge for Jess.
Jess accepts typed AST-v2 Fn values here
and provides the shared Jess-owned bridge for Less-style plugin function
registration and Less-shaped function values.
The public compiler does not support Less 4 visitors, post-processors, file manager plugins, or a full Less tree AST adapter.
Fn values from @jesscss/core; their
bodies receive typed values and FnCtx capabilities.install(less, manager, functions) through plugins. The bridge supplies a
Less-shaped functions.functionRegistry and the supported less.tree
constructor facades, then lazily adapts function arguments and return values at
the Jess boundary.For example, migrate a Less functionRegistry.add('increment', fn) contribution
to a typed function and register it through functions:
import { Compiler } from 'jess';
import { defineFunction, makeDimension } from '@jesscss/core';
import lessCompatPlugin from '@jesscss/plugin-less-compat';
const increment = defineFunction('increment', {
params: [{ type: 'Dimension' }] as const,
body: value => makeDimension(value.number + 1, value.unit)
});
const compiler = new Compiler({
compile: { plugins: [lessCompatPlugin({ functions: [increment] })] }
});
For legacy Less function plugins:
const legacyPlugin = {
install(less, _manager, functions) {
functions.add('increment', value =>
new less.tree.Dimension(value.value + 1, value.unit)
);
}
};
const compiler = new Compiler({
compile: { plugins: [lessCompatPlugin({ plugins: [legacyPlugin] })] }
});
Less-shaped values are boundary values only. Jess owns their conversion back into typed AST-v2 values. The current bridge supports function registration and value conversion; it does not install a broad Less tree facade for visitors or prototype-patching plugins.
Alpha / experimental. The supported public routes are native function contribution and Less plugin function bridging. If you need Less visitors, post-processors, file managers, or broad Less tree AST mutation support today, use Less.js directly.
The programmatic plugin/compiler API is not yet stabilized — the jess CLI
is the documented public surface for the alpha. Watch the
docs site for the API once it settles. Current
design notes live in DESIGN.md.
FAQs
Less.js compatibility layer for Jess - enables Less plugins and visitors to work with Jess AST
The npm package @jesscss/plugin-less-compat receives a total of 614 weekly downloads. As such, @jesscss/plugin-less-compat popularity was classified as not popular.
We found that @jesscss/plugin-less-compat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.