
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@pierre/highlights
Advanced tools
@pierre/highlights is a syntax highlighter written in WebAssembly Text (WAT).
It supports 80 built-in languages and Zed-compatible themes. It produces HTML or
themed tokens from complete input, input chunks, or document edits.
Read the Documentation.
pnpm add @pierre/highlights
The package runs in Node.js, browsers, and Cloudflare Workers. It initializes
WebAssembly at import. codeToHtml() and codeToTokens() run synchronously
after import.
import { codeToHtml } from '@pierre/highlights';
import { pierreDark } from '@pierre/highlights/themes';
const htmlBytes = codeToHtml("console.log('Hello world!')", {
lang: 'js',
theme: pierreDark,
});
const html = new TextDecoder().decode(htmlBytes);
codeToHtml() returns UTF-8 HTML bytes that can share WebAssembly memory.
Decode the bytes before the next call to the highlighter. Use .slice() to keep
a copy for later use.
Read the API reference for tokens, input streams, document edits, and themes.
moonx highlights:build
moonx highlights:dev
moonx highlights:test
moonx highlights:bench
moonx highlights:bench-live
moonx highlights:bench-memory
Benchmarks · Architecture · Bundled themes
FAQs
A fast code highlighter written in WebAssembly Text(Wat), from Pierre
The npm package @pierre/highlights receives a total of 1,056 weekly downloads. As such, @pierre/highlights popularity was classified as popular.
We found that @pierre/highlights demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.