
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
highlightjs-glimmer
Advanced tools
glimmer syntax highlighting with highlight.js
yarn add highlightjs-glimmer
# or
npm install highlightjs-glimmer
Requires: highlight.js >= v11
| Remark | Rehype | MarkdownIt | |
|---|---|---|---|
| cjs | ✅ | ✅ | ✅ |
| esm | ❌1 | ✅ | ✅ |
import hljs from 'highlight.js';
import { setup } from 'highlightjs-glimmer';
setup(hljs);
hljs.highlightAll();
javascript language must be registered before setup is called.setup must be called before any highlighting occurs.Supported language tags:
<pre>
<code class="language-{tag}">
where {tag} could be:
NOTE because highlightjs-glimmer overrides the same aliases as highlightjs' handlebars grammar, to use the handlebars grammar align with the glimmer grammar, you'll need to use the full name in class
<pre><code class="lang-glimmer">...</code></pre>
<pre><code class="lang-handlebars">...</code></pre>
await import(...)When using ES Modules in browsers with a packager
let HIGHLIGHT;
async function getHighlighter() {
if (HIGHLIGHT) return HIGHLIGHT;
HIGHLIGHT = (await import('highlight.js')).default;
let { setup } = await import('highlightjs-glimmer');
setup(HIGHLIGHT);
return HIGHLIGHT;
}
async highlight() {
let hljs = await getHighlighter();
let element = document.querySelector('...');
hljs.highlightElement(element);
}
highlight();
setup
The convenience method for configuring everything related to
glimmer highlighting. This wraps registerLanguage and registerInjections.
For most use cases, this should be the only method you need.
registerLanguage
Convenience method for registering the glimmer syntax with highlight.js under the name "glimmer"
registerInjections
Configures injections in supported languages where it's common to use glimmer syntax.
glimmer
The highlight.js grammar function. This can be used to register the glimmer grammar under a name other than "glimmer".
<script type="text/javascript" src="/cdn/path/to/highlight.min.js"></script>
<script type="text/javascript" src="/cdn/path/to/highlightjs-glimmer/glimmer.js"></script>
<script type="text/javascript">hljs.highlightAll();</script>
At this time, highlight.js does not ship ES Modules to CDNs
<script type="text/javascript" src="/cdn/path/to/highlight.min.js"></script>
<script type="module">
import { glimmer } from '/cdn/path/to/highlightjs-glimmer/glimmer.esm.js';
hljs.registerLanguage('glimmer', glimmer);
hljs.highlightAll();
</script>
requireconst hljs = require('highlight.js');
const { setup } = require('highlightjs-glimmer');
setup(hljs);
hljs.highlightAll();
Only Node 14 is supported
importimport hljs from 'highlight.js';
import { setup } from 'highlightjs-glimmer';
setup(hljs);
hljs.highlightAll();
With Node 14, launch with
NODE_OPTIONS="--experimental-vm-modules" node your-module-script.js
Debug with yarn debug -p 4201
Visit http://localhost:4201
Run Tets with yarn test or npm run test
remark-highlight.js is deprecated and cjs only ↩
FAQs
Glimmer syntax highlighting with Highlight.JS
The npm package highlightjs-glimmer receives a total of 22,986 weekly downloads. As such, highlightjs-glimmer popularity was classified as popular.
We found that highlightjs-glimmer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.