
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@bun-win32/shcore
Advanced tools
Zero-dependency, zero-overhead Win32 SHCORE bindings for Bun (FFI) on Windows.
Zero-dependency, zero-overhead Win32 SHCORE bindings for Bun on Windows.
@bun-win32/shcore exposes the shcore.dll exports using Bun's FFI. It provides a single class, Shcore, which lazily binds native symbols on first use. You can optionally preload a subset or all symbols up-front via Preload().
The bindings are strongly typed for a smooth DX in TypeScript.
shcore.dll (DPI awareness, scale factors, AppUserModelID, random access streams, registry helpers, and more).structs/Shcore.ts with links to Microsoft Docs.Shcore.Preload()).types/Shcore.ts).bun add @bun-win32/shcore
import Shcore, { ProcessDpiAwareness } from '@bun-win32/shcore';
// Optionally bind a subset up-front
Shcore.Preload(['SetProcessDpiAwareness', 'GetScaleFactorForDevice']);
// Opt in to per-monitor DPI awareness (0 on success)
const hr = Shcore.SetProcessDpiAwareness(ProcessDpiAwareness.PROCESS_PER_MONITOR_DPI_AWARE);
console.log('SetProcessDpiAwareness hr: 0x%s', (hr >>> 0).toString(16));
// Read the preferred scale factor for the primary display (DEVICE_PRIMARY = 0)
const scale = Shcore.GetScaleFactorForDevice(0);
console.log('Primary display scale: %d%%', scale);
[!NOTE] AI agents: see
AI.mdfor the package binding contract and source-navigation guidance. It explains how to use the package without scanning the entire implementation.
Run the included examples:
bun run example:dpi-scope # Visualize DPI, scale, and shell UI sizing
bun run example:shcore # Process DPI awareness + AppUserModelID roundtrip
Shcore.Preload().Optional<T> (formally optional, SAL _*opt_) and Nullable<T> (plain [in]/[out] the docs say can be NULL), the null sentinel derived from T (null for pointers LP*/P*, 0n for handles/by-value addresses); direction is in the parameter name — _out (_Out_), _in_out (_Inout_), _In_ bare. See AI.md and the repo AGENTS.md.FAQs
Zero-dependency, zero-overhead Win32 SHCORE bindings for Bun (FFI) on Windows.
The npm package @bun-win32/shcore receives a total of 65 weekly downloads. As such, @bun-win32/shcore popularity was classified as not popular.
We found that @bun-win32/shcore demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.