JavaScript

Draco is a Rust-based, self-hostable web scraper designed as an alternative to Firecrawl and headless Chrome solutions. It uses a tiered escalation system to bypass anti-bot measures, render JavaScript-heavy sites, and fall back to real browsers when needed, offering improved performance and lower resource usage compared to existing tools.

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript to instruct browsers to assemble malware directly in memory. The attack leverages JavaScript to build malware within browser memory, bypassing traditional detection methods.

WordPress patched a critical core vulnerability chain called wp2shell, which allows attackers to gain full control of sites without authentication, leading to risks like credential theft, malware delivery, and malicious redirects for visitors. Attackers have already begun exploiting the flaw, injecting harmful content and compromising user trust.

A security flaw in the Claude for Chrome browser extension, called ClaudeBleed, allows malicious extensions to impersonate the Claude website and force the assistant to perform unauthorized actions, such as reading Gmail or manipulating documents. Anthropic addressed some issues but researchers claim the core vulnerability remains unresolved, enabling rogue extensions to exploit permissions granted to Claude.

Ant is a JavaScript runtime and ecosystem that includes a package manager (ants.land), a deployment platform, and Ant Desktop for building native desktop apps. The project aims to function as a cohesive platform while maintaining compatibility with the broader JavaScript ecosystem. It is currently in early development, with the author seeking feedback on its direction and features.

Homegames is an open-source game platform developed over 8 years, featuring JavaScript-based games with accessible source code and an in-browser editor for creating and publishing games. The project's code is hosted on GitHub, and the creator seeks feedback on games, studio features, and the platform.

The article titled 'The Birth and Death of JavaScript (2014)' discusses the origins and challenges of JavaScript. It references a talk available on Destroy All Software's website and includes Hacker News comments and engagement metrics.

Cybersecurity researchers identified six vulnerabilities in protobuf.js, a JavaScript and TypeScript implementation of Protocol Buffers, which could allow remote code execution (RCE) and denial-of-service (DoS) attacks in Node.js applications through malicious schemas or payloads.

Kyushu is a self-hostable WebAssembly (WASM) sandbox designed for JavaScript workers, showcased on Hacker News. The project provides a secure execution environment for running JavaScript code in isolated environments.

Ableton introduces an Extensions SDK that allows users to build features for Live using JavaScript, expanding beyond its existing Max for Live tool which focuses on MIDI and audio processing. The new system enables modifications to nearly any part of the DAW via right-clicking, with example extensions for tasks like bulk track renaming, song arrangement sketching, and sample slicing.

Websites can now track SSD activity through browsers using the FROST technique, which employs JavaScript to measure telltale drive behavior.

A coordinated supply chain attack has compromised eight packages on Packagist, injecting malicious code that executes a Linux binary hosted on GitHub Releases. The attack targeted JavaScript projects by inserting malicious content into package.json, bypassing composer.json in Composer packages.

Deno released version 2.8, a JavaScript and TypeScript runtime. The release announcement was posted on the official Deno blog with minimal initial engagement on Hacker News.

Google accidentally disclosed details about an unfixed security vulnerability in Chromium that allows JavaScript to execute in the background after the browser is closed, enabling remote code execution on affected devices. The leaked information about this critical flaw poses a significant security risk to users until a patch is developed and released.

Anza has released Solana Kit 6.9, which adds support for fixed-point numbers and a first-class Sol type, enabling exact decimal and binary math in JavaScript. This release also includes updates such as Agave v3.x vote-account and simulateTransaction fields. The kit is available at solanakit.com.

A dozen critical security vulnerabilities have been found in the vm2 Node.js library, which could allow bad actors to escape the sandbox and execute arbitrary code on susceptible systems. The vm2 library is used to run untrusted JavaScript code inside a secure sandbox. This vulnerability puts systems using the library at risk of arbitrary code execution.

The article discusses how an individual made $350K from an open-source JavaScript library using dual licensing, a strategy that allows for both free and paid usage of the software. The library was shared on platforms like GitHub, allowing for widespread adoption and revenue generation. This approach highlights the potential for monetizing open-source projects.

Browser Harness is a new tool that grants LLMs maximum freedom to perform browser tasks by removing restrictive frameworks. It uses Chrome's CDP websocket with self-correction and dynamic tool creation, enabling LLMs to handle edge cases like file downloads and cross-origin iframes autonomously. Examples include playing Stockfish, setting Tetris records, and generating JavaScript to draw a heart.

FluidCAD is a parametric CAD tool developed using JavaScript, designed to streamline 3D modeling with features like live rendering, interactive modes, and implicit coding. The project, still in early development, aims to reduce mental effort for CAD designers while maintaining familiar workflows.