
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
github.com/aaronpowell/webpack-golang-wasm-async-loader
Generates a WASM package from Golang and provides an async interface for working with it
npm install --save-dev golang-wasm-async-loader
This is a loader for webpack that is used for generating WebAssembly (aka WASM) bundles from Go.
The JavaScript bridge that is then generated for webpack will expose the WebAssembly functions as a Promise for interacting with.
module.exports = {
...
module: {
rules: [
{
test: /\.go/,
use: ['golang-wasm-async-loader']
}
]
},
node: {
fs: 'empty'
}
};
You import your Go code just like any other JavaScript module you might be working with. The webpack loader will export a default export that has the functions you registered in Go on it. Unfortunately it currently doesn't provide autocomplete of those function names as they are runtime defined.
import wasm from './main.go'
async function init() {
const result = await wasm.add(1, 2);
console.log(result);
}
Here's the main.go
file:
package main
import (
"strconv"
"syscall/js"
"github.com/aaronpowell/webpack-golang-wasm-async-loader/gobridge"
)
func add(i ...js.Value) js.Value {
ret := 0
for _, item := range i {
val, _ := strconv.Atoi(item.String())
ret += val
}
return js.ValueOf(ret)
}
func main() {
c := make(chan struct{}, 0)
gobridge.RegisterCallback("add", add)
<-c
}
As part of this repository a Go package has been created to improve the interop between the Go WASM runtime and work with the async pattern the loader defines.
To do this a function is exported from the package called RegisterCallback
which takes two arguments:
string
representing the name to register it as in JavaScript (and what you'll call it using)func
to register as a callback
func
must has a signature of (args ...js.Value) js.Value
and you are responsible to box/unbox the JavaScript values to the appropriate Go types. Similarly you need to box the return type as a js.Value
In JavaScript a global object is registered as __gobridge__
which the registrations happen against.
MIT
Aaron Powell
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.