
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@r1-runtime/sw
Advanced tools
Service Worker for R1 — handles asset:// URL interception and VFS asset loading.
Service Worker for R1 — handles asset:// URL interception and VFS asset loading.
asset:// URLs and serves files from VFS@r1-runtime/corenpm install @r1-runtime/sw
This package is automatically used by @r1-runtime/core. You don't need to import or configure it manually.
The Service Worker is registered when you call:
import { R1Runtime } from '@r1-runtime/core';
const runtime = new R1Runtime();
await runtime.boot(); // Registers the Service Worker
The Service Worker intercepts requests to the asset:// protocol and serves files from the Virtual File System:
// In your Rust code:
let content = std::fs::read_to_string("/app/assets/logo.png")?;
// In your frontend:
<img src="asset://localhost/app/assets/logo.png" />
The Service Worker:
asset:// request/app/assets/logo.pngasset://localhost/* - Maps to VFS root /asset://embedded/* - Maps to embedded resourcesThe Service Worker automatically detects MIME types based on file extensions:
.html → text/html.css → text/css.js → application/javascript.json → application/json.png → image/png.jpg, .jpeg → image/jpeg.svg → image/svg+xml.wasm → application/wasmTo see Service Worker logs, open DevTools → Application → Service Workers and check "Show console logs".
MIT © 2026 R1 Runtime Team
FAQs
Service Worker for R1 — handles asset:// URL interception and VFS asset loading.
We found that @r1-runtime/sw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.