
Research
/Security News
GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.
@laziest/resource-manager
Advanced tools
@laziest/resource-managerBrowser-only resource loading with static plans, priority scheduling, blocking groups, and background continuation.
@laziest/resource-manager lets you describe resources as a static plan, schedule them by group and item priority, wait for blocking groups, keep non-blocking groups loading in the background, and observe runtime progress through snapshots and subscriptions.
ResourcePlan declarationsreadypnpm add @laziest/resource-manager
fetch, AbortController, and URLFontFace support when loading fontsIf your target browsers do not provide these APIs, load the polyfills before creating a ResourceRuntime.
pnpm add whatwg-fetch abortcontroller-polyfill core-js
import 'whatwg-fetch'
import 'abortcontroller-polyfill/dist/abortcontroller-polyfill-only'
import 'core-js/actual/url'
Notes:
whatwg-fetch is a browser-only fetch() polyfill and should be loaded on the clientabortcontroller-polyfill fills AbortController and AbortSignal; use the fetch patch entry only if your environment needs itcore-js/actual/url can be used when URL is missing in older browsers@core-js/unplugin, or another build step, prefer that single source of truth instead of importing them twiceimport {
ResourceRuntime,
createResourcePlan,
} from '@laziest/resource-manager'
const plan = createResourcePlan({
groups: [
{
key: 'bootstrap',
priority: 100,
blocking: true,
items: [
{ type: 'json', url: '/api/bootstrap.json' },
{ type: 'font', url: '/fonts/brand.woff2', family: 'Brand Sans' },
],
},
{
key: 'hero',
priority: 80,
blocking: true,
items: [{ type: 'image', url: '/images/hero.webp' }],
},
{
key: 'background',
priority: 10,
blocking: false,
items: [
{ type: 'image', url: '/images/gallery-1.webp', optional: true },
{ type: 'video', url: '/video/loop.mp4', optional: true },
],
},
],
})
const runtime = new ResourceRuntime(plan, {
maxConcurrentItems: 4,
retry: { maxRetries: 2, delayMs: 250, backoff: 'exponential' },
})
const run = runtime.start()
await run.waitForReady()
renderApp()
await run.waitForAll()
waitForReady() resolves when every blocking group has completed all required resources. Non-blocking groups may still be loading.
waitForAll() resolves after every group has reached a terminal state.
A plan is a static declaration. Each group is a scheduling and readiness unit.
const plan = createResourcePlan({
groups: [
{
key: 'critical',
priority: 100,
blocking: true,
items: [
{ type: 'image', url: '/images/logo.png', priority: 100 },
{ type: 'json', url: '/data/app.json', priority: 80 },
],
},
{
key: 'later',
priority: 10,
blocking: false,
items: [{ type: 'image', url: '/images/gallery.png' }],
},
],
})
Scheduling order is deterministic:
group.priorityitem.priorityblocking and optional are separate concepts:
blocking: true means the group is required before runtime readinessoptional: true means a resource failure becomes a warning instead of failing its groupmaxConcurrentItems limits the number of actively loading items in a run. Priorities decide queue order; they do not preempt items that have already started.
Every item has a type and url.
const items = [
{ type: 'image', url: '/images/hero.webp' },
{ type: 'font', url: '/fonts/brand.woff2', family: 'Brand Sans' },
{ type: 'audio', url: '/audio/click.mp3', preload: 'auto' },
{ type: 'video', url: '/video/intro.mp4', preload: 'metadata' },
{ type: 'json', url: '/api/bootstrap.json' },
{ type: 'text', url: '/copy/legal.txt' },
{ type: 'binary', url: '/models/mesh.bin' },
{ type: 'lottie', url: '/animations/intro.json' },
] as const
Supported types:
imagefontaudiovideolottiejsontextbinaryconst run = runtime.start()
const unsubscribe = run.subscribe(({ snapshot }) => {
console.log(snapshot.status)
console.log(snapshot.progress)
console.log(snapshot.groups)
})
try {
await run.waitForReady()
await run.waitForAll()
} finally {
unsubscribe()
}
Run statuses:
idlerunningreadycompletedfailedabortedSnapshot fields include:
statusstartedAtreadyAtendedAtprogressgroupsactiveItemserrorswarningsconst cache = new Map<string, unknown>()
const runtime = new ResourceRuntime(plan, {
cache: {
get: (key) => cache.get(key),
set: (key, value) => void cache.set(key, value),
},
retry: {
maxRetries: 2,
delayMs: 200,
backoff: 'linear',
},
})
const run = runtime.start()
setTimeout(() => {
run.abort()
}, 5000)
Runtime behavior:
aborted and rejects pending waitersimport {
ResourceRunError,
ResourceRuntime,
createResourcePlan,
} from '@laziest/resource-manager'
const run = new ResourceRuntime(plan).start()
try {
await run.waitForReady()
} catch (error) {
if (error instanceof ResourceRunError) {
console.error(run.getSnapshot().errors)
} else {
throw error
}
}
Failure categories include:
httpnetworktimeoutabortdecodeparseunsupportedunknownFAQs
面向浏览器应用的资源加载库,支持静态 plan、优先级调度、blocking group 与后台续载。
The npm package @laziest/resource-manager receives a total of 24 weekly downloads. As such, @laziest/resource-manager popularity was classified as not popular.
We found that @laziest/resource-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.

Security News
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.

Security News
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.