
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
@iota/client-wasm
Advanced tools
WebAssembly (Wasm) bindings for TypeScript/JavaScript to the iota.rs client library.
The iota.rs client library also offers dedicated Node.js bindings. The differences with this package are outlined below.
| Wasm bindings | Node.js bindings | |
|---|---|---|
| Environment | Node.js, browsers | Node.js |
| Installation | - | Rust, Cargo required* |
| Performance | ✔️ | ✔️✔️ |
| Proof-of-work | Single-threaded | Multi-threaded |
| MQTT | ❌ | ✔️ |
| Stronghold | ❌ | ✔️ |
| Ledger Nano | ❌ | ✔️ |
*Node.js bindings only need to be compiled during npm install if a pre-compiled binary is not available for your platform.
tl;dr: Use the Node.js bindings if you can. The Wasm bindings are just more portable and support browser environments.
wasm-bindgen (cargo install wasm-bindgen-cli);$ npm i @iota/client-wasm
$ yarn add @iota/client-wasm
After installing the library, you can create a Client instance and interface with it.
const { Client } = require('@iota/client-wasm/node');
const client = new Client({
nodes: ['https://api.testnet.shimmer.network'],
});
client.getInfo().then(console.log).catch(console.error);
See the Node.js examples for more demonstrations, the only change needed is to import @iota/client-wasm/node instead of @iota/client.
Unlike Node.js, a few more steps are required to use this in the browser.
The library loads the compiled Wasm file with an HTTP GET request, so the client_wasm_bg.wasm file must be copied to the root of the distribution folder.
A bundler such as webpack or rollup is recommended.
rollup-plugin-copy:npm install rollup-plugin-copy --save-dev
rollup.config.js:// Include the copy plugin.
import copy from 'rollup-plugin-copy'
// ...
// Add the copy plugin to the `plugins` array:
copy({
targets: [{
src: 'node_modules/@iota/client-wasm/web/wasm/client_wasm_bg.wasm',
dest: 'public',
rename: 'client_wasm_bg.wasm'
}]
})
copy-webpack-plugin:npm install copy-webpack-plugin --save-dev
webpack.config.js:// Include the copy plugin.
const CopyWebPlugin = require('copy-webpack-plugin');
// ...
experiments: {
// futureDefaults: true, // includes asyncWebAssembly, topLevelAwait etc.
asyncWebAssembly: true
}
// Add the copy plugin to the `plugins` array:
plugins: [
new CopyWebPlugin({
patterns: [
{
from: 'node_modules/@iota/client-wasm/web/wasm/client_wasm_bg.wasm',
to: 'client_wasm_bg.wasm'
}
]
}),
// other plugins...
]
import { init, Client } from "@iota/client-wasm/web";
init().then(() => {
const client = new Client({
nodes: ['https://api.testnet.shimmer.network'],
});
client.getInfo().then(console.log).catch(console.error);
}).catch(console.error);
// Default path to load is "client_wasm_bg.wasm",
// but you can override it by passing a path explicitly.
//
// init("./static/client_wasm_bg.wasm").then(...)
FAQs
WebAssembly bindings for the IOTA client library
The npm package @iota/client-wasm receives a total of 26 weekly downloads. As such, @iota/client-wasm popularity was classified as not popular.
We found that @iota/client-wasm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.