
Research
/Security News
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.
@node-rs/jieba
Advanced tools
@node-rs/jiebajieba-rs binding to NodeJS
node-rs/jieba was prebuilt into binary already, so you don't need fighting with node-gyp and c++ toolchains.
Due to jieba-rs is 33% faster than cppjieba, and N-API is faster than v8 C++ API, @node-rs/jieba is faster than nodejieba.
@node-rs/jieba x 3,763 ops/sec ±1.18% (92 runs sampled)
nodejieba x 2,783 ops/sec ±0.67% (91 runs sampled)
Cut 1184 words bench suite: Fastest is @node-rs/jieba
@node-rs/jieba x 16.10 ops/sec ±1.58% (44 runs sampled)
nodejieba x 9.81 ops/sec ±2.39% (29 runs sampled)
Cut 246568 words bench suite: Fastest is @node-rs/jieba
@node-rs/jieba x 1,739 ops/sec ±0.87% (92 runs sampled)
nodejieba x 931 ops/sec ±1.31% (89 runs sampled)
Tag 1184 words bench suite: Fastest is @node-rs/jieba
@node-rs/jieba x 6.19 ops/sec ±2.01% (20 runs sampled)
nodejieba x 3.06 ops/sec ±5.39% (12 runs sampled)
Tag 246568 words bench suite: Fastest is @node-rs/jieba
| node 10 | node12 | node13 | node14 | |
|---|---|---|---|---|
| Windows 64 latest | ✓ | ✓ | ✓ | ✓ |
| macOS latest | ✓ | ✓ | ✓ | ✓ |
| Linux | ✓ | ✓ | ✓ | ✓ |
const { load, cut } = require('@node-rs/jieba')
load()
cut('我们中出了一个叛徒', false)
// ["我们", "中", "出", "了", "一个", "叛徒"]
const { load, cut } = require('@node-rs/jieba')
load()
extract(
'今天纽约的天气真好啊,京华大酒店的张尧经理吃了一只北京烤鸭。后天纽约的天气不好,昨天纽约的天气也不好,北京烤鸭真好吃',
3,
)
// ["北京烤鸭", "纽约", "天气"]
FAQs
Fastest Chinese word segmentation in Node.js
The npm package @node-rs/jieba receives a total of 139,458 weekly downloads. As such, @node-rs/jieba popularity was classified as popular.
We found that @node-rs/jieba demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Published late February to early March 2026, these crates impersonate timeapi.io and POST .env secrets to a threat actor-controlled lookalike domain.

Security News
A recent burst of security disclosures in the OpenClaw project is drawing attention to how vulnerability information flows across advisory and CVE systems.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.