
Research
/Security News
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
Locutus other languages' standard libraries to JavaScript for fun and educational purposes
All your standard libraries will be assimilated into our
JavaScriptTypeScript collective. Resistance is futile.
Locutus is ~500 TypeScript implementations of standard library functions from PHP, Go, Python, Ruby, C, and more. Each function is individually importable and tree-shakeable.
Most of these started as rainy Sunday afternoon puzzles. Some are genuinely useful. Some are just fun to write. All of them are a way to learn how different languages solve the same problems.
Locutus ports function behavior, not foreign runtime baggage. We reimplement standard-library semantics in TypeScript, but keep API boundaries JavaScript-native.
That means we do not recreate alien language data structures or object models in Locutus APIs (for example: Go slices/maps, Python tuples/bytes, Ruby symbols, C structs/pointers, Perl refs).
Historic exception: for PHP compatibility, plain JS objects may be treated as associative arrays when locutus.objectsAsArrays is enabled.
Example: a Go date-formatting port in Locutus should accept a JavaScript Date and return a string, not a custom Go time.Time object.
npm install locutus
Locutus uses pragmatic versioning: patch is the default even for function-level parity fixes; see
CONTRIBUTING.md#versioning for exact bump criteria.
import { sprintf } from 'locutus/php/strings/sprintf'
const effectiveness = 'futile'
console.log(sprintf('Resistance is %s', effectiveness))
// Resistance is futile
import { Contains } from 'locutus/golang/strings/Contains'
console.log(Contains('Locutus', 'cut'))
// true
For bundle-sensitive browser builds, prefer per-function deep imports over category index imports.
Good:
import { sprintf } from 'locutus/php/strings/sprintf'
Avoid in browser bundles:
import { sprintf } from 'locutus/php/strings/index'
Why:
If you are publishing your own browser bundle on top of Locutus, treat deep imports as the default.
Code shown on function pages (Module JS / Standalone JS) targets:
baseline widely available with downstreamPackage runtime targets:
engines.node >= 22dist/ CommonJS + dist/esm ESM): ES2022If your application targets older browsers, treat Locutus snippets like normal application code:
Locutus does not inject polyfills into copy-paste snippets by default.
Some guidelines and instructions can be found in CONTRIBUTING.md
Quick commands:
yarn check - format + lint + testyarn test:parity - cross-language verificationyarn test - full test suiteyarn lint - Biome checkyarn fix:biome - auto-fixMIT, except for src/php/bc/ and src/php/_helpers/_bc.js which are LGPL-2.1 (derived from PHP's bcmath/Libbcmath). See LICENSE for details.
Underscore is a JavaScript library that provides utility functions for common programming tasks. It offers a wide range of functions for manipulating arrays, objects, and other data types. Unlike Locutus, which ports functions from other languages, Underscore is designed specifically for JavaScript.
Lodash is a modern JavaScript utility library delivering modularity, performance, and extras. It provides a wide range of utility functions for common programming tasks, similar to Underscore but with additional features and optimizations. Lodash is focused on JavaScript and does not port functions from other languages like Locutus.
Ramda is a functional programming library for JavaScript that emphasizes immutability and side-effect-free functions. It provides a wide range of utility functions for functional programming. Unlike Locutus, which ports functions from other languages, Ramda is designed specifically for functional programming in JavaScript.
FAQs
Locutus other languages' standard libraries to JavaScript for fun and educational purposes
The npm package locutus receives a total of 475,941 weekly downloads. As such, locutus popularity was classified as popular.
We found that locutus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.