
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
codemcp-executor-quickjs
Advanced tools
Tier 0 codemcp executor: QuickJS compiled to WebAssembly, running on a Node worker thread with memory, stack and deadline limits.
The default sandbox (tier 0). Each execution gets a fresh QuickJS runtime, compiled to WebAssembly, inside a fresh Node worker thread.
Limits are enforced in layers that do not rely on the guest cooperating: QuickJS memory, stack and deadline interrupts; the worker's own V8 heap cap; and a host-side timer that terminates the worker.
The guest sees two string-only host functions. Everything else (tools.*, console) is built in the guest prelude on top of them.
import { QuickJsExecutor } from "codemcp-executor-quickjs";
const executor = new QuickJsExecutor({ timeoutMs: 10_000 });
const result = await executor.execute("return await tools.echo.say({ hi: 1 });", {
"echo.say": async (args) => args,
});
Passes every case in codemcp-conformance.
FAQs
Tier 0 codemcp executor: QuickJS compiled to WebAssembly, running on a Node worker thread with memory, stack and deadline limits.
The npm package codemcp-executor-quickjs receives a total of 829 weekly downloads. As such, codemcp-executor-quickjs popularity was classified as not popular.
We found that codemcp-executor-quickjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.