
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
create-holoscript-app
Advanced tools
Create HoloScript apps with zero configuration — scaffold 3D/XR projects and preview in your browser in under 2 minutes
Create HoloScript apps with zero configuration. Scaffold a working 3D/XR project and see it in your browser in under 2 minutes.
HoloScript is the open AI-spatial reality protocol — a declarative language for building 3D worlds, VR/AR experiences, and spatial applications.
npx create-holoscript-app my-world
cd my-world
npm install
npm run dev
Your 3D scene opens at http://localhost:5173 🚀
hello-world (default)Interactive scene with a grabbable cube, glowing orb, and a button that spawns objects.
composition "Hello World" {
object "MyCube" {
@grabbable
@physics(mass: 1.0)
geometry: "cube"
position: [0, 1.5, -3]
color: "#ff4444"
}
}
physics-playgroundArena with throwable objects, bouncy balls, stacked cubes, and a spinning torus.
interactive-galleryArt gallery with clickable glowing panels, portal rings, and a floating sculpture.
npx create-holoscript-app <project-name> [options]
Options:
--template <name> Template to use (hello-world, physics-playground, interactive-gallery)
--yes, -y Skip prompts, use defaults
my-world/
├── src/scene.holo # Your scene — edit this!
├── index.html # HTML shell with WebXR support
├── main.js # Three.js runtime with orbit controls
├── vite.config.js # Dev server with .holo hot reload
├── holoscript.config.json # Project config
├── package.json
└── README.md
The dev server uses a custom Vite plugin that parses .holo files and injects scene data into a Three.js renderer. Edit your .holo file and save — the browser reloads automatically.
// Create objects
object "MyObject" {
geometry: "cube" // cube, sphere, plane, cylinder, cone, torus
position: [0, 1, -3] // [x, y, z]
rotation: [0, 45, 0] // degrees
scale: [1, 1, 1] // or single number
color: "#ff4444" // hex color
}
// Add behavior with traits
@grabbable // User can grab
@throwable // User can throw
@physics(mass: 1.0) // Physics sim
@collidable // Collision
@glowing(intensity: 2.0) // Emissive glow
@clickable // Click events
@hoverable // Hover effects
.holo scenesMIT
FAQs
Create HoloScript apps with zero configuration — scaffold 3D/XR projects and preview in your browser in under 2 minutes
We found that create-holoscript-app demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.