
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
Support for dynamic linking of WebAssembly code via Javascript built using wasm32-unknown-emscripten
This is a WebAssembly dynamic loader for the ABI used by emscripten and the llvm backend when targeting emscripten. It runs both on node.js and in the browser. It supports the libc provided by Zig, not emscripten.
When you build your code, you have to link in the static archive file dist/wasm/libdylink.a, and provide some flags:
zig cc -target wasm32-wasi app.c -o build/wasm/app.wasm \
-L path/to/dist/wasm/ -ldylink \
-rdynamic -shared -fvisibility=default \
-Xlinker --import-memory -Xlinker --import-table
Then the following functions will be available to use from app.c:
extern void* dlopen(const char* filename, int flags);
extern void* dlsym(void* handle, const char* symbol);
There are examples in the tests/ subdirectories.
I care about implementing enough of the linker spec to support loading Python extension modules. In particular, I'm probably not worried about dependencies, i.e., automatically loading all the dynamic libraries that dynamic library depends on.
There is already code in emscripten itself that fully implements the dynamic loader spec. However, I would like to build and run WebAssembly modules using a lightweight modern toolchain built around Zig instead. It is thus necessary to implement a self-contained dynamic loader.
PR's welcome to implement more!
There doesn't seem to be an actual write up of how dynamic linking actually works with WebAssembly, and I think the official WebAssembly project gave up on it in favor of other things that don't exist yet. it got implemented for emscripten (mainly here).
-fPIC (position independent code), which is really what makes dynamic linking possible.FAQs
Support for dynamic linking of WebAssembly code via Javascript built using wasm32-unknown-emscripten
We found that dylink demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.