Web security tools usually scan only JavaScript code and not CSS. Furthermore, they only scan a static version of the JavaScript code, without actually executing it.