
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@pierre/highlights
Advanced tools
@pierre/highlights is a syntax highlighter written in WebAssembly Text (WAT),
with 67 built-in languages and Zed-compatible themes. It generates HTML or
themed tokens and supports streaming input and incremental edits.
Read the Documentation.
pnpm add @pierre/highlights
Runs in Node.js, browsers, and Cloudflare Workers. The package initializes WebAssembly automatically; highlighting calls are synchronous after import.
import { codeToHtml } from '@pierre/highlights';
import { pierreDark } from '@pierre/highlights/themes';
const htmlBytes = codeToHtml("console.log('Hello world!')", {
lang: 'js',
theme: pierreDark,
});
const html = new TextDecoder().decode(htmlBytes);
codeToHtml() returns UTF-8 HTML bytes. Decode them immediately, or copy them
with .slice() before the next highlighting or tokenization call.
See the docs for token rendering, streaming, incremental editing, themes, and the API reference.
moonx highlights:build
moonx highlights:dev
moonx highlights:test
moonx highlights:bench
moonx highlights:bench-live
Benchmarks · Architecture · Bundled themes
FAQs
A fast code highlighter written in WebAssembly Text(Wat), from Pierre
The npm package @pierre/highlights receives a total of 1,056 weekly downloads. As such, @pierre/highlights popularity was classified as popular.
We found that @pierre/highlights demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.