
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@getforma/compiler
Advanced tools
[](https://www.npmjs.com/package/@getforma/compiler) [](https://opensource.org/licenses/MIT)
Compiler and build plugins for FormaJS. Transforms h() calls into pre-compiled templates for faster rendering, handles "use server" function transforms, and emits FMIR binary for Rust SSR.
This is an optimization layer — FormaJS works without it. Add the compiler when you want faster initial renders or Rust-based SSR.
npm install -D @getforma/compiler
formaCompilerTransforms h() calls into template() + cloneNode() at build time. Instead of creating DOM elements one by one at runtime, the browser clones a pre-built template — significantly faster for complex component trees.
// vite.config.ts
import { defineConfig } from "vite";
import { formaCompiler } from "@getforma/compiler";
export default defineConfig({
plugins: [formaCompiler()],
});
Before (runtime):
h("div", { class: "card" },
h("h2", null, "Title"),
h("p", null, () => description()),
)
After (compiled):
const _tmpl = template("<div class='card'><h2>Title</h2><p></p></div>");
const _root = _tmpl.cloneNode(true);
createEffect(() => { _root.querySelector("p").textContent = description(); });
formaCompiler({
// Include/exclude file patterns (default: all .ts/.tsx/.js/.jsx)
include: ["src/**/*.tsx"],
exclude: ["node_modules"],
})
formaServerTransforms functions with the "use server" directive into RPC stubs (client build) or registered endpoints (server build).
// vite.config.ts
import { defineConfig } from "vite";
import { formaCompiler, formaServer } from "@getforma/compiler";
export default defineConfig({
plugins: [
formaCompiler(),
formaServer({ mode: "client" }), // or "server"
],
});
Source:
async function createTodo(text: string) {
"use server";
return db.insert("todos", { text });
}
Client output:
import { $$serverFunction } from "@getforma/core/server";
const createTodo = $$serverFunction("/rpc/createTodo_a1b2c3");
Server output:
import { registerServerFunction } from "@getforma/core/server";
async function createTodo(text: string) {
return db.insert("todos", { text });
}
registerServerFunction("/rpc/createTodo_a1b2c3", createTodo);
formaSsrPluginEmits FMIR (Forma Module IR) binary files for Rust-based server-side rendering. Only needed with the full Forma stack (forma-ir + forma-server).
import { formaSsrPlugin } from "@getforma/compiler";
// Used by @getforma/build, not typically called directly
Parses entry points to extract component trees, signal defaults, and island boundaries for IR emission.
import { ComponentAnalyzer } from "@getforma/compiler";
const analyzer = new ComponentAnalyzer();
const entry = analyzer.parseEntryPoint("src/app.tsx");
const component = analyzer.parseComponentFile(entry.importPath, entry.componentName);
| Scenario | Need compiler? |
|---|---|
| Learning FormaJS, building prototypes | No |
| Production app with Vite | Optional — adds faster rendering |
"use server" functions (RPC) | Yes — transforms the directive |
Rust SSR with forma-server | Yes — emits FMIR binary |
HTML Runtime (data-* directives) | No — runtime handles everything |
vite >=5.0.0 (optional — for Vite plugins)esbuild >=0.17.0 (optional — for esbuild SSR plugin)| Package | Description |
|---|---|
| @getforma/core | Reactive DOM library — signals, h(), islands, SSR hydration |
| @getforma/compiler | This package — h() optimization, server transforms, IR emission |
| @getforma/build | Production pipeline — bundling, hashing, compression, manifest |
| Package | Description |
|---|---|
| forma-ir | FMIR binary format — parser, walker, WASM exports |
| forma-server | Axum middleware — SSR page rendering, asset serving, CSP headers |
| Package | Description |
|---|---|
| @getforma/create-app | npx @getforma/create-app — scaffolds a Rust server + TypeScript frontend project |
MIT
FAQs
[](https://www.npmjs.com/package/@getforma/compiler) [](https://opensource.org/licenses/MIT)
We found that @getforma/compiler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.