
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
Nova64 โ Ultimate 3D Fantasy Console runtime for JavaScript games powered by Three.js
Nova64 is a revolutionary fantasy console that brings the magic of Nintendo 64 and PlayStation era 3D graphics to the modern web. Experience the perfect fusion of retro aesthetics with cutting-edge technology, featuring full GPU acceleration, advanced lighting systems, and spectacular visual effects that rival modern games while maintaining that nostalgic charm.
โจ Pure 3D Gaming Experience โ Advanced Three.js integration with Nintendo 64/PlayStation-style rendering, holographic materials, dynamic lighting, and cinematic post-processing effects!
๐ Live Site: starcade9.github.io
Nova64 is wired for MemPalace-backed project memory through .vscode/mcp.json.
On Windows, the MCP server starts through WSL and uses the shared ~/ai-tools
Pipenv environment:
cd ~/ai-tools
pipenv run mempalace-mcp
For day-to-day work, use the repo shortcuts:
pnpm run mempalace:wake
pnpm run mempalace:status
pnpm run mempalace:repair-status
pnpm run mempalace:mine:retroarch
Use mempalace:mine:retroarch after meaningful RetroArch renderer or cart
progress so future sessions can recover the latest parity context quickly.
The native libretro core lives in retroarch/README.md.
That folder also carries the active RetroArch handoff, backlog, smoke matrix, and
MemPalace diary:
retroarch/HANDOFF_HWGL.md - current hardware-GL
implementation state and validation numbers.retroarch/BACKLOG.md - queued RetroArch parity and
cleanup work.retroarch/GLES_SMOKE_MATRIX.md - manual
real-driver smoke coverage.You don't have to build from source. Pre-built RetroArch cores for every major platform are published on the GitHub Releases page. Each release ships:
Desktop
nova64_libretro.dll โ Windows x86_64nova64_libretro.so โ Linux x86_64nova64_libretro.dylib โ macOS universal (x86_64 + arm64)ARM single-board computers
nova64_libretro_linux_aarch64.so โ Linux ARM64, Pi 4/5 with a 64-bit OSnova64_libretro_linux_armhf.so โ Linux ARMHF, Pi 2/3/Zero 2 with a 32-bit OSAndroid (rename the matching file to nova64_libretro_android.so and drop
into your RetroArch core path)
nova64_libretro_android_arm64-v8a.so โ modern phonesnova64_libretro_android_armeabi-v7a.so โ older 32-bit phonesnova64_libretro_android_x86_64.so โ emulators, ChromebooksPlus SHA256SUMS.txt for verification.
Drop the file matching your platform into your RetroArch cores/ directory,
then load any .nova cart from your Nova64 playlist.
Builds are produced by the
Release RetroArch cores GitHub Action
on every v*.*.* tag, and can also be triggered manually from the Actions tab
for one-off releases. See RELEASING.md for the publisher's
guide โ what gets built, how to cut a release, how to add a new target
platform, and troubleshooting.
Generated RetroArch binaries, build outputs, and capture artifacts should stay out of commits.
Nova64 carts run end-to-end through a native Godot 4.x host via a GDExtension that embeds QuickJS. The host, the cart shim, the conformance harness, and the visual-parity tooling are all part of the main build. See ROADMAP.md Phase 3 and docs/GODOT_VOXEL_PLAN.md for the in-flight sub-plans.
minecraft-demo, f-zero-nova-3d,
star-fox-nova-3d, space-harrier-3d, fps-demo-3d (with WAD map
picker), plus the full 00โ10 conformance series and the standard
3D/UI/particle demos.fps-demo-3d loads freedoom1.wad through
nova64.wad.load() and presents a start-screen map picker (Up/Down
to select, Enter to start, Esc returns from gameplay). Rendering
fidelity for WAD walls/flats/sprites is still being lifted to
Three.js/Babylon parity โ see the Improving Godot WAD rendering
notes below.minecraft-demo boots end-to-end with
full HUD, hotbar, biome label, and rolling biome-tinted terrain
rendered via Godot MultiMesh. 64ร64 column render distance with fog
falloff. All voxel carts pass the smoke harness.drawText, drawTextShadow,
drawTextOutline, setFont, setTextAlign, setTextBaseline,
plus setInstanceTransform / setInstancePosition for instanced
meshes โ HUDs in f-zero / star-fox / space-harrier render correctly
under Godot.cd nova64-godot/gdextension && scons platform=linux target=template_debug
(and the matching Windows MinGW invocation).
See nova64-godot/README.md.powershell -File nova64-godot/scripts/run-cart-smoke.ps1 <cart-name>
for each cart for 300 frames against the conformance
harness.The Godot WAD renderer currently uses a partial flat-shaded path for several wall/flat cases. Bringing it to Three.js/Babylon parity is tracked in ROADMAP.md Phase 3 โ WAD Sub-Roadmap. Open items:
COLORMAP lookup so dark sectors read
correctly without baking light into texture memory.THINGS sprite billboards (transparent pixels, rotation
tables) to match the browser renderer.MAPINFO / UMAPINFO map names when available.wad-demo capture to pnpm godot:visual.โ ๏ธ Non-regression rule: any shared adapter, atlas, sampler, or fog/frustum change made to improve WAD rendering must not degrade voxel rendering. The voxel path (compact columns โ C++ greedy mesher โ split opaque/transparent atlas surfaces) is the most fragile shared seam in the Godot host. Before landing a WAD-driven change, run
pnpm godot:visual minecraft-demoand avoxel-creative/voxel-terrainsmoke and confirm no parity drift.
wad-demo gameplay-frame comparison is back in the low-single-digit diff range against Three.js@babylonjs/core 9.4.1enableAR() and enableVR() use Babylon's own WebXR experience path in Babylon modetsl-showcase scene now uses seeded star placement so Babylon.js and Three.js screenshots compare the same galaxy layouttests/playwright/visual-regression.spec.js includes a tsl-showcase Galaxy scene comparison so future shader/post-processing changes have a narrow parity checkThe libretro core (retroarch/nova64_libretro.c) gained another wave of
parity work and a hardened release pipeline:
parseCanvasUI extensions: <image> tags, text effects, quadratic
paths, smooth cubic paths, SVG arcs, group clipping, advanced cube
transparency, and font families now render through the XML UI runtime.KeyZ/KeyX/KeyC/KeyV, and SELECT to KeyI/Tab, so
inventory/menu-style carts work on a gamepad without per-cart edits.release-cores.yml now ships
nova64_libretro_linux_armhf.so via dockcross/linux-armv7, joining
Linux x86_64, macOS universal, Windows, Linux ARM64 (Pi), and Android
(3 ABIs).-fPIC from a pinned GitHub tag and preserve shell quoting end-to-end.prepublishOnly strengthened from validate && build to
lint && test:all && build โ npm publishes now block on lint + the
full test:all suite.dist/.AGENTS.md is now the single source of truth for repo
guidance across all coding agents (Claude, Codex, Gemini, Copilot).
CLAUDE.md and friends are thin pointers.
nova64.* Namespace โญNova64 carts now run against a single, canonical, discoverable API surface. The
old "100+ bare globals on window" surface has been retired โ every cart in the
official gallery (all 71+) and every internal runtime callsite has been migrated.
nova64.draw.*, nova64.scene.*, nova64.camera.*,
nova64.light.*, nova64.fx.*, nova64.shader.*, nova64.input.*,
nova64.audio.*, nova64.physics.*, nova64.voxel.*, nova64.ui.*,
nova64.tween.*, nova64.sprite.*, nova64.data.*, nova64.util.*,
nova64.xr.*, nova64.wad.*runtime/namespace.js (NAMESPACE_MAP +
buildNamespace()) is the canonical cart-facing contract โ Three.js, Babylon,
and Godot all bind through the same shape.Object.assign(globalThis, โฆ): The runtime no longer pollutes the
global scope. Carts get a clean, IDE-friendly object tree.scripts/migrate-to-namespace.{cjs,js} and
scripts/audit-carts.mjs shipped alongside the migration so contributors can
rewrite legacy carts in seconds.The Babylon backend now has a first-class Noa-engine voxel adapter sitting
behind Nova64's shared voxel API โ the same nova64.voxel.* calls that drive
the Three.js Minecraft demo can now route through Babylon-native chunk meshing.
runtime/backends/babylon/noa-adapter.js + noa-prototype.js provide the
Babylon-side seam.The Godot 4.x native host has graduated from "experimental side branch" to a fully integrated trunk citizen. JavaScript carts execute inside QuickJS embedded in a GDExtension, rendered by Godot's native renderer.
minecraft-demo (full HUD, hotbar,
biome-tinted MultiMesh terrain at 64ร64 columns), f-zero-nova-3d,
star-fox-nova-3d, space-harrier-3d, fps-demo-3d (with WAD map picker),
and the full 00โ10 conformance series.freedoom1.wad loads through nova64.wad.load()
with a start-screen map picker.code.js files.wad-demo parity is back in the low-single-digit pixel diff.@babylonjs/core 9.4.1) for enableAR() /
enableVR(), with Cardboard fallback when native WebXR is unavailable.runtime/cart-reset.js) โ no more
silent state leaks between cart loads._loadGeneration) in the cart loader.enableRetroEffects / disableRetroEffects,
updateLODs, isEffectsEnabled, renderEffects) all resolve through the
namespace, so a stale binding can no longer silently no-op.nova64.* destructuring.on handler, put X into Y, send messages, repeat/if/else control flow, and HyperCard-style object referencesfadeIn, slideIn, pulse, shake, etc.).hcard.json or as a Nova64 .code.js cartt(), setLocale(), getLocale(), addStrings(), getAvailableLocales() for translatable cartst variable clash)noa-engine adapter (runtime/backends/babylon/noa-adapter.js) lets Babylon back the shared nova64.voxel.* API with native chunk meshing โ same cart, two voxel runtimesenableN64Mode(), enablePSXMode(), enableLowPolyMode() for authentic retro looks# Install globally
pnpm add -g nova64
# Create a new game project
nova64 init my-game
cd my-game && nova64 dev
Your browser opens to a spinning cube starter at http://localhost:5173 โ edit code.js and see changes instantly.
# Browse 60+ example games and demos interactively
nova64 template
# Or clone a specific template directly
nova64 template star-fox-nova-3d
cd star-fox-nova-3d && nova64 dev
git clone https://github.com/seacloud9/nova64.git
cd nova64
pnpm install
pnpm dev
# Visit http://localhost:5173
nova64 init [name] # Scaffold a new project (prompts if name omitted)
nova64 template [name] # Pick from 60+ example templates
nova64 dev # Start dev server for the current project
nova64 --start-demo # Launch console with all demos (requires build)
nova64 --help # Show all options
Options:
-p, --port NUM # Port to listen on (default: 3000)
--no-open # Don't auto-open the browser
# In the browser while running any cart:
F9 # Toggle debug panel (scene graph, camera, lights, stats)
Shift+X # Toggle dev console (cheats, meta.json, env, entities)
?debug=1 # Add to URL to auto-open debug panel on load
Nova64 also ships a native RetroArch core under retroarch/. It runs carts
through QuickJS and native Nova64 host APIs; it does not embed a browser,
Three.js, or Babylon.js. The current native renderer path targets OpenGL ES 3.1,
with Vulkan 1.2 staged behind the backend-neutral renderer interface.
On Windows, run these from WSL after selecting Node 20:
nvm use 20
pnpm run retroarch:test # Native conformance harness
pnpm run retroarch:build # Clean release Make build
pnpm run retroarch:build:debug # Clean debug Make build
pnpm run retroarch:scons:debug # Debug SCons build path
pnpm run retroarch:validate # Conformance + Make + debug + SCons checks
pnpm run retroarch:clean # Remove generated RetroArch build outputs
See retroarch/README_RETROARCH.md and retroarch/RETROARCH_CORE_PLAN.md for the current milestone plan.
nova64/
โโโ index.html # Main console launcher
โโโ package.json # Dependencies & scripts
โโโ bin/nova64.js # CLI entry point (init, template, dev, --start-demo)
โโโ bin/commands/ # CLI subcommand implementations
โ โโโ init.js # Project scaffolding (code.js, package.json, index.html)
โ โโโ template.js # Interactive template picker (60+ examples)
โ โโโ dev.js # Vite dev server for user projects
โโโ src/main.js # Core engine bootstrap
โโโ runtime/ # Advanced 3D Engine runtime + public API layer
โ โโโ gpu-threejs.js # Public Three.js backend wrapper
โ โโโ gpu-babylon.js # Public Babylon backend wrapper
โ โโโ backends/ # Internal backend implementations (threejs/, babylon/)
โ โโโ shared/ # Cross-backend runtime contracts and helpers
โ โโโ debug-panel.js # F9 debug panel (scene graph, camera, lights, stats)
โ โโโ env.js # Environment config + Shift+X dev console (cheats, meta)
โ โโโ api.js # Core 2D API (cls, pset, line, rect, print)
โ โโโ api-3d.js # 3D API (createCube, setCameraPosition, etc.)
โ โโโ api-effects.js # Post-processing effects (bloom, vignette, glitch)
โ โโโ api-skybox.js # Skybox system (space, gradient, solid)
โ โโโ api-sprites.js # 2D sprite system with GPU batching
โ โโโ api-voxel.js # Voxel engine API (blocks, chunks, entities)
โ โโโ cart-reset.js # Shared cart-load reset hook registry
โ โโโ api-gameutils.js # Game utilities (shake, cooldowns, spawners, pools)
โ โโโ api-generative.js # Generative art utilities
โ โโโ api-presets.js # Preset configurations
โ โโโ input.js # Input system (WASD, gamepad, mouse, touch)
โ โโโ audio.js # Spatial 3D audio system
โ โโโ physics.js # Physics with AABB collision and gravity
โ โโโ collision.js # Raycasting and spatial partitioning
โ โโโ storage.js # Persistent game data (localStorage)
โ โโโ screens.js # Screen/state management system
โ โโโ ui.js # UI components (buttons, panels, progress bars)
โ โโโ wad.js # DOOM WAD file loader and renderer
โ โโโ console.js # Nova64 class with ES module cart loading
โ โโโ framebuffer.js # High-precision RGBA64 framebuffer
โ โโโ font.js # Bitmap font rendering
โ โโโ i18n.js # Internationalization
โ โโโ ... # editor, store, manifest, nft-seed, logger, etc.
โโโ os9-shell/ # Mac OS 9-Style Desktop Environment
โ โโโ src/
โ โโโ apps/ # Desktop apps (GameStudio, ModelViewer, hyperNova, etc.)
โ โ โโโ hypernova/ # HyperCard/Flash authoring tool with NovaTalk scripting
โ โโโ components/ # Window manager, taskbar, desktop UI
โ โโโ i18n.ts # Internationalization (EN/ES/JA)
โ โโโ os/ # OS-level services and state
โ โโโ theme/ # Retro Mac OS 9 styling
โโโ examples/ # 47 Demo Carts
โ โโโ minecraft-demo/ # Voxel world with mining and building
โ โโโ star-fox-nova-3d/ # Space combat with squadron battles
โ โโโ f-zero-nova-3d/ # High-speed futuristic racing
โ โโโ cyberpunk-city-3d/ # Neon-lit metropolis
โ โโโ dungeon-crawler-3d/ # First-person dungeon exploration
โ โโโ wizardry-3d/ # Classic RPG dungeon crawler
โ โโโ wing-commander-space/# Space flight sim
โ โโโ super-plumber-64/ # 3D platformer
โ โโโ ... # 39 more demos
โโโ docs/ # API documentation (HTML & Markdown)
โโโ tests/ # Test suites
runtime/ stays the stable public layer. The public runtime/gpu-threejs.js and
runtime/gpu-babylon.js entrypoints now delegate into runtime/backends/{threejs,babylon},
while runtime/shared/ holds cross-backend contracts and helpers used by both renderers.
Babylon also has a dedicated compatibility layer in runtime/backends/babylon/compat.js
for cart-facing Three-style expectations such as scene.traverse, mesh.visible,
material.map, color helpers, and texture repeat/offset parity.
Engine-level Babylon material assignment now resolves both numeric mesh IDs and mesh
proxies, which keeps WAD-generated wall/floor/sprite materials attached in the same
cart-facing path as Three.js.
Voxel carts now also have a backend-native Babylon path in runtime/backends/babylon/voxel.js,
with runtime/api-voxel.js delegating chunk/entity mesh creation through backend-aware helpers
instead of constructing raw Three.js meshes in Babylon mode.
The backend split and parity rules are documented in
docs/BACKEND_RUNTIME.md.
That document also covers the shared cart-reset lifecycle used to clear runtime state on cart loads and dashboard cart switches.
Nova64 carts are ES modules with three lifecycle functions:
let player, ground;
let score = 0;
export function init() {
// Create ALL 3D objects here โ never inside draw()
ground = createPlane(50, 50, 0x2a4d3a, [0, 0, 0]);
rotateMesh(ground, -Math.PI / 2, 0, 0);
player = createCube(1, 0x0088ff, [0, 1, 0], { material: 'metallic' });
setFog(0x1a1a2e, 10, 30);
setAmbientLight(0x334466, 1.0);
}
export function update(dt) {
// Handle input and game logic
if (key('KeyW')) setPosition(player, 0, 1, -5 * dt);
if (key('KeyS')) setPosition(player, 0, 1, 5 * dt);
setCameraPosition(0, 5, 10);
setCameraTarget(0, 1, 0);
}
export function draw() {
// 2D HUD overlay โ 3D renders automatically
print(`Score: ${score}`, 10, 10, 0xffffff);
}
Load your cart by changing the import path in src/main.js.
// Camera
setCameraPosition(x, y, z);
setCameraTarget(x, y, z);
setCameraFOV(degrees);
// Atmospheric
setFog(color, near, far);
clearFog();
setAmbientLight(color, intensity);
createPointLight(color, intensity, distance, [x, y, z]);
// Primitives โ createX(size/args, color, [x,y,z], options?)
createCube(size, color, [x,y,z], { material, metalness, roughness, emissive, ... })
createCube(width, height, depth, color, [x,y,z], options)
createSphere(radius, color, [x,y,z], options)
createPlane(w, h, color, [x,y,z], options)
createCylinder(radiusTop, radiusBottom, height, color, [x,y,z], options)
createCone(radius, height, color, [x,y,z], options)
createCapsule(radius, length, color, [x,y,z], options)
createTorus(radius, tube, color, [x,y,z], options)
// Material types: 'standard', 'metallic', 'holographic', 'emissive'
// Transforms
rotateMesh(mesh, x, y, z)
setPosition(mesh, x, y, z)
setScale(mesh, x, y, z)
removeMesh(mesh) // also: destroyMesh(mesh)
key(keyCode); // Keyboard key held
keyp(keyCode); // Key just pressed
btn(index); // Gamepad button held
btnp(index); // Gamepad button just pressed
(mouseX(), mouseY()); // Mouse position
mouseButton(index); // Mouse button state
cls(color?) // Clear screen
pset(x, y, color) // Set pixel
line(x0, y0, x1, y1, color)
rect(x, y, w, h, color, fill?)
circ(cx, cy, r, color, fill?)
print(text, x, y, color)
printCentered(text, y, color)
drawGlowText(text, x, y, color)
drawCrosshair(x, y, size, color)
drawProgressBar(x, y, w, h, pct, fgColor, bgColor)
createSpaceSkybox();
createGradientSkybox(topColor, bottomColor);
createSolidSkybox(color);
enableSkyboxAutoAnimate(speed);
enableBloom(strength, radius, threshold);
enableVignette(darkness, offset);
enableGlitch(amount);
enableChromaticAberration(offset);
enableN64Mode();
enablePSXMode();
enableLowPolyMode();
sfx(preset); // Named presets: 'jump', 'coin', 'explosion', ...
sfx({ wave, freq, dur }); // Custom sound
setVolume(level); // Master volume 0.0โ1.0
saveData(key, value)
loadData(key, fallback?)
deleteData(key)
updateVoxelWorld(playerX, playerY, playerZ);
setVoxelBlock(x, y, z, blockType);
getVoxelBlock(x, y, z);
raycastVoxelBlock(origin, direction, maxDist);
checkVoxelCollision(x, y, z, w, h, d);
spawnVoxelEntity(type, x, y, z, components);
configureVoxelWorld(options);
saveVoxelWorld(name);
loadVoxelWorld(name);
createShake() / triggerShake() / updateShake();
createCooldown() / useCooldown() / updateCooldowns();
createPool() / createSpawner() / updateSpawner();
createStateMachine() / createTimer();
createFloatingTextSystem() / drawFloatingTexts();
createMinimap(opts) / drawMinimap(mm, time);
createBody(options);
stepPhysics(dt);
setGravity(x, y, z);
setCollisionMap(fn);
pnpm test # Run all tests
pnpm test:api # 3D API functions
pnpm test:input # Input system
pnpm test:starfox # Star Fox demo validation
pnpm test:integration # Integration tests
pnpm run retroarch:test # RetroArch native conformance harness
Nova64 uses progressive enhancement with automatic fallback:
MIT โ see LICENSE for details.
parseCanvasUI extensions: <image> tags, text effects, quadratic / smooth cubic paths, SVG arcs, group clipping, advanced cube transparency, font familiesKeyZ/KeyX/KeyC/KeyV, SELECT โ KeyI/Tabrelease-cores.yml via dockcross/linux-armv7-fPIC zlib from pinned GitHub tag, preserved shell quotingprepublishOnly hardened from validate && build to lint && test:all && buildprepublishOnlynova64.* namespace: 100+ bare globals retired; all 71+ demo carts and every runtime callsite migrated to nova64.draw.*, nova64.scene.*, nova64.fx.*, nova64.voxel.*, etc. Single canonical contract in runtime/namespace.jsruntime/backends/babylon/noa-adapter.js lets Babylon back the shared voxel API with native chunk meshingminecraft-demo, f-zero-nova-3d, star-fox-nova-3d, space-harrier-3d, fps-demo-3d (with WAD map picker) running natively via GDExtension+QuickJS; JS syntax highlighting + ESLint in the Godot editor@babylonjs/core 9.4.1) with Cardboard fallback, deterministic TSL galaxy guardrailscripts/migrate-to-namespace.{cjs,js}, scripts/audit-carts.mjs, scripts/walk-carts.mjst() API for cartsSee CHANGELOG.md for full version history.
FAQs
Nova64 โ Ultimate 3D Fantasy Console runtime for JavaScript games powered by Three.js
The npm package nova64 receives a total of 210 weekly downloads. As such, nova64 popularity was classified as not popular.
We found that nova64 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.