
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
This package is now a thin TypeScript wrapper around the Rust `abi_reflect` runtime. We compile the Rust crate to WebAssembly, ship both Node + bundler targets, and expose a small async API for reflecting ABI YAML + binary payloads. All layout math and va
This package is now a thin TypeScript wrapper around the Rust abi_reflect
runtime. We compile the Rust crate to WebAssembly, ship both Node + bundler
targets, and expose a small async API for reflecting ABI YAML + binary payloads.
All layout math and validation run inside the Rust engine so TypeScript stays
lightweight and automatically inherits IR upgrades.
import { ensureWasmLoaded, formatReflection, reflect } from "@thru/abi";
import tokenAbi from "./abi/token_program.abi.yaml?raw";
async function example() {
await ensureWasmLoaded(); // formatter + reflector live inside WASM
const payload = new Uint8Array([0x01, 0, 0, 0, 0, 0, 0, 0]);
const reflection = await reflect(tokenAbi, "TokenInstruction", {
type: "binary",
value: payload,
});
console.log(reflection.value); // JSON emitted by abi_reflect
// Collapse the verbose JSON tree into something human-readable
const formatted = formatReflection(reflection);
console.log(formatted.value.payload.variant); // "initialize_mint"
}
example();
serde_json. They include the full type
info + value trees used by the CLI tooling.| Function | Description |
|---|---|
reflect(abi: string, typeName: string, payload: { type: "binary", value: BinaryLike } | { type: "hex", value: string }) | Reflects binary data (or hex) and returns the parsed JSON payload. |
formatReflection(raw: JsonValue) | Delegates to the WASM formatter to collapse verbose JSON trees. Requires ensureWasmLoaded() (or any prior call to reflect) before use. |
buildLayoutIr(abi: string) | Runs the shared Layout IR builder and returns the serialized IR document (schema version, per-type expressions, parameters). |
ensureWasmLoaded() | Preloads the WASM bindings for callers that want to pay the initialization cost up-front. reflect calls it lazily. |
All helpers are async, because loading + instantiating the WASM module can touch the filesystem (Node) or issue dynamic imports (bundlers).
The generated artifacts live under web/packages/abi/wasm/{bundler,node,web} and are
checked in so the package works without a local Rust toolchain. When
abi_reflect or the shared IR changes, rebuild everything with:
# From repo root
pnpm --filter @thru/abi run build:wasm
That script runs wasm-pack build three times (bundler + node + web targets) inside
rpc/abi/abi_reflect_wasm, then copies the fresh outputs into
web/packages/abi/wasm. The regular pnpm --filter @thru/abi build step runs
tsup and copies those WASM folders into dist/wasm so published packages
resolve the dynamic imports automatically.
When developing inside the monorepo, Vitest loads the TypeScript sources
directly. The runtime detects when it is executing from src/ and reaches for
../wasm, so make sure the synced artifacts exist before running the tests.
pnpm --filter @thru/abi test
Vitest exercises both reflectHex and reflectBinary against the
SimpleStruct compliance ABI plus buildLayoutIr to ensure the WASM bridge is
wired correctly. If you tweak the Rust runtime, rerun pnpm build:wasm so the
tests pick up the updated binaries.
src/wasmBridge.ts. Node loads the
wasm/node build via createRequire, while bundlers dynamically import the
wasm/bundler module.reflect* matches abi_reflect's CLI output, so
parity debugging can use the abi-reflect CLI under rpc/abi/abi_reflect.buildLayoutIr into caches or ship a prebuilt
snapshot alongside the WASM runtime to guard against future schema changes.Questions? Ping the thru-net ABI team (same folks maintaining
rpc/abi/abi_reflect). Whenever you extend the Rust reflection engine or shared IR,
regenerate the WASM artifacts and mention the change in enums-fam-impl.md so
tooling consumers know which version to depend on.
FAQs
This package is now a thin TypeScript wrapper around the Rust `abi_reflect` runtime. We compile the Rust crate to WebAssembly, ship both Node + bundler targets, and expose a small async API for reflecting ABI YAML + binary payloads. All layout math and va
We found that @thru/abi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.