
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@huggingface/blake3-jit
Advanced tools
Temporary fork of blake3-jit with Hasher.reset() and pre-allocated buffers. Will be deprecated once upstream blake3-jit exposes reset().
Temporary fork of
blake3-jitwith performance patches for@huggingface/xetchunk-wasm.
This package will be deprecated once the upstream blake3-jit package exposes the reset() method and pre-allocated internal buffers.
blake3-jit@1.0.0Hasher.reset() — Resets the hasher to process a new message with the same key/flags, reusing all internal buffers (zero allocations). This avoids creating a new Hasher per chunk in hot loops.
Pre-allocated internal buffers — parentBlock, parentCv, chunkCv, outWords, and finalizeCv are allocated once in the constructor instead of per-call in addChunkCv, update, finalize, and finalizeOutput.
Removed Uint32Array view construction in ChunkState.update — The byte-by-byte readLittleEndianWordsFull path is faster than creating a Uint32Array view (avoids TypedArray constructor overhead) and also fixes a crash on unaligned subarrays.
The changes are also available as a pnpm patch at packages/xetchunk-wasm/patches/blake3-jit.patch in the huggingface.js monorepo.
import { Hasher } from '@huggingface/blake3-jit';
const key = new Uint8Array(32);
const hasher = Hasher.newKeyed(key);
// Hash multiple messages without reallocating
const hash1 = hasher.update(data1).finalize(32);
const hash2 = hasher.reset().update(data2).finalize(32);
const hash3 = hasher.reset().update(data3).finalize(32);
FAQs
Temporary fork of blake3-jit with Hasher.reset() and pre-allocated buffers. Will be deprecated once upstream blake3-jit exposes reset().
We found that @huggingface/blake3-jit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.