
Security News
minimatch Patches 3 High-Severity ReDoS Vulnerabilities
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
Wrappers for built-in Web Workers enabling easy parallel data processing.
Browser Web Workers work fine, but have terrible APIs (just like most "web APIs"). Node.js doesn't have workers, while polyfilling them using node APIs breaks bundlers.
How could one pass a code to a worker?
eval. Would break CSP and importsCheck out webpack docs on webworkers.
The library could also be used in single-threaded manner: provide threads option to initBatch.
Then slow functions can be ran outside of main thread, with async API.
npm install micro-wrkr
deno add jsr:@paulmillr/micro-wrkr
deno doc jsr:@paulmillr/micro-wrkr# command-line documentation
main.jsimport { bn254 } from '@noble/curves/bn254';
import { type ProjConstructor, type ProjPointType } from '@noble/curves/abstract/weierstrass';
import wrkr from 'micro-wrkr';
import { type Handlers } from './msm-worker.js';
function reducePoint<T>(p: ProjConstructor<T>) {
return (lst: ProjPointType<T>[]) =>
lst.map((i) => new p(i.px, i.py, i.pz)).reduce((acc, i) => acc.add(i), p.ZERO);
}
export function initMSM() {
// Type-safe
// worker should be in same directory as main thread code
const { methods, terminate } = wrkr.initBatch<Handlers>(
() => new Worker(new URL('./msm-worker.js', import.meta.url), { type: 'module' }),
{
// optional reducers
bn254_msmG1: reducePoint(bn254.G1.ProjectivePoint),
bn254_msmG2: reducePoint(bn254.G2.ProjectivePoint),
}
);
// Use `terminate` to stop workers when app is paused or exported from library.
// Otherwise, it won't terminate.
return { methods, terminate };
}
msm-worker.jsimport { bn254 } from '@noble/curves/bn254';
import wrkr from 'micro-wrkr';
import { type ProjConstructor, type ProjPointType } from '@noble/curves/abstract/weierstrass';
type MSMInput<T> = { point: ProjPointType<T>; scalar: T };
function buildMSM<T>(point: ProjConstructor<T>) {
return (lst: MSMInput<T>[]): ProjPointType<T> => {
if (!lst.length) return point.ZERO;
const points = lst.map((i: any) => new point(i.point.px, i.point.py, i.point.pz));
const scalars = lst.map((i: any) => i.scalar);
return point.msm(points, scalars);
};
}
const handlers = {
bn254_msmG1: buildMSM(bn254.G1.ProjectivePoint),
bn254_msmG2: buildMSM(bn254.G2.ProjectivePoint),
};
// Export Handlers type for type-safety
export type Handlers = typeof handlers;
wrkr.initWorker(handlers);
new Worker(new URL(e.p+e.u(44),e.b),{type:void 0})# when no google chrome, thorium can also be used
export CHROME_BIN='/Applications/Thorium.app/Contents/MacOS/Thorium'
npm run build && npm run test:full
MIT (c) Paul Miller (https://paulmillr.com), see LICENSE file.
FAQs
Wrappers for built-in Web Workers enabling easy parallel data processing
The npm package micro-wrkr receives a total of 1 weekly downloads. As such, micro-wrkr popularity was classified as not popular.
We found that micro-wrkr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.

Research
/Security News
Socket uncovered 26 malicious npm packages tied to North Korea's Contagious Interview campaign, retrieving a live 9-module infostealer and RAT from the adversary's C2.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.