Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
By Olivia Brown - Sep 22, 2025
@tresjs/core
Advanced tools
TresJS @tresjs/core
Declarative ThreeJS using Vue Components
- 💡 Build 3D scene as they were Vue components
- ⚡️ Powered by Vite
- 🥰 It brings all the updated features of ThreeJS right away regardless the version
- 🦾 Fully Typed
Tres (Spanish word for "three", pronounced /tres/ ) is a way of creating ThreeJS scenes with Vue components in a declarative fashion.
It's build on-top of a Vue Custom Renderer and it's powered by Vite.
The goal is to provide the Vue's community an easy way of building 3D scenes with Vue, always up to date with the latest ThreeJS features and with 0-to-none maintenance.
Installation
pnpm install @tresjs/core three
Docs
Checkout the docs
Demos
Ecosystem
| Package | Version |
|---|---|
| Tres |  |
| Cientos |  |
| Post-processing |  |
| Nuxt |  |
| TresLeches 🍰 |  |
Contribution
We are open to contributions, please read the contributing guide to get started.
Setup
pnpm install --shamefully-hoist
Playground
To run the small playground
pnpm run playground
Build lib
To build the core as library mode just use
pnpm run build
Docs
To run de docs in dev mode
pnpm run docs:dev
To build them
pnpm run docs:build
License
Sponsors
Keywords
FAQs
Declarative ThreeJS using Vue Components
The npm package @tresjs/core receives a total of 8,125 weekly downloads. As such, @tresjs/core popularity was classified as popular.
We found that @tresjs/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Package last updated on 20 Jun 2025
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Related posts
Research
/Security News
Identifying and Preventing Fraudulent Engineering Candidates: An Investigation into 80 Confirmed Cases
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
By Lauren Valencia, Kirill Boychenko - Sep 17, 2025
Application Security
/Research
/Security News
Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.
By Kush Pandya, Peter van der Zee, Olivia Brown, Socket Research Team - Sep 16, 2025