
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@grain/js-runner
Advanced tools
The JavaScript runner for the Grain language.
This project makes it easier to get your Grain programs running in a JavaScript environment—either Node.js or the browser. If your Grain code is compiled in unlinked mode (--no-link), @grain/js-runner will perform module resolution and load all necessary modules.
To install the package, install it from npm:
npm install @grain/js-runner
The package provides two versions of the runner. One for the browser and one for node.
In the browser, without a bundler, add this as a script to your index.html:
<script src="node_modules/@grain/js-runner/dist/grain-runner-browser.js"></script>
<script>
// You'll also need to install the @grain/stdlib package
let locator = Grain.defaultURLLocator(["/", "node_modules/@grain/stdlib"]);
let GrainRunner = Grain.buildGrainRunner(locator);
GrainRunner.runURL("hello.gr.wasm");
</script>
The easiest way to get running in the browser is to fork the grain-web-example.
In node, you can require the runner:
let Grain = require("@grain/js-runner");
let locator = Grain.defaultFileLocator([
__dirname,
require.resolve("@grain/stdlib"),
]);
let GrainRunner = Grain.buildGrainRunner(locator);
GrainRunner.runFile("hello.gr.wasm");
You can also just use the Grain CLI to run your files, like grain run hello.gr.wasm.
MIT
FAQs
The JavaScript runner for the Grain language.
We found that @grain/js-runner demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.