
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
es-toolkit
Advanced tools
A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.


es-toolkit is a state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.
// import from '@es-toolkit/es-toolkit' in jsr.
import { chunk, debounce } from 'es-toolkit';
const debouncedLog = debounce(message => {
console.log(message);
}, 300);
// This call will be debounced
debouncedLog('Hello, world!');
const array = [1, 2, 3, 4, 5, 6];
const chunkedArray = chunk(array, 2);
console.log(chunkedArray);
// Output: [[1, 2], [3, 4], [5, 6]]
es-toolkit provides Agent Skills for AI coding tools like Claude Code, Cursor, and Copilot.
npx skills add toss/es-toolkit
For Claude Code, you can also install via the plugin marketplace:
/plugin marketplace add toss/es-toolkit
/plugin install es-toolkit@es-toolkit-plugin
For more details, see the AI Integration guide.
We welcome contributions from everyone in the community. Read below for a detailed contribution guide.
MIT © Viva Republica, Inc. See LICENSE for details.
FAQs
A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.
The npm package es-toolkit receives a total of 26,955,906 weekly downloads. As such, es-toolkit popularity was classified as popular.
We found that es-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.