
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
A from-scratch experimental AOT optimizing JS/TS -> Wasm/C engine/compiler/runtime in JS. Research project, not yet intended for serious use.
Porffor is a very unique JS engine, due many wildly different approaches. It is seriously limited, but what it can do, it does pretty well. Key differences:
Porffor is primarily built from scratch, the only thing that is not is the parser (using Acorn). Binaryen/etc is not used, we make final wasm binaries ourself. You could imagine it as compiling a language which is a sub (some things unsupported) and super (new/custom apis) set of javascript. Not based on any particular spec version.
Expect nothing to work! Only very limited JS is currently supported. See files in bench
for examples.
npm install -g porffor@latest
. It's that easy (hopefully) :)
porf
. Just run it with no script file argument.
porf path/to/script.js
porf wasm path/to/script.js out.wasm
. Currently it does not use an import standard like WASI, so it is mostly unusable on its own.
[!WARNING] Compiling to native binaries uses 2c, Porffor's own Wasm -> C compiler, which is experimental.
porf native path/to/script.js out(.exe)
. You can specify the compiler with --compiler=clang|gcc|zig
(clang
by default), and which optimization level to use with --cO=Ofast|O3|O2|O1|O0
(Ofast
by default). Output binaries are also stripped by default.
[!WARNING] Compiling to C uses 2c, Porffor's own Wasm -> C compiler, which is experimental.
porf c path/to/script.js (out.c)
. When not including an output file, it will be printed to stdout instead.
[!WARNING] Experimental WIP feature!
porf profile path/to/script.js
[!WARNING] Very experimental WIP feature!
porf debug path/to/script.js
--parser=acorn|@babel/parser|meriyah|hermes-parser
(default: acorn
) to set which parser to use--parse-types
to enable parsing type annotations/typescript. if -parser
is unset, changes default to @babel/parser
. does not type check--opt-types
to perform optimizations using type annotations as compiler hints. does not type check--valtype=i32|f64
(default: f64
) to set valtype-O0
to disable opt-O1
(default) to enable basic opt (simplify insts, treeshake wasm imports)-O2
to enable advanced opt (partial evaluation). unstable!Promise
and await
have known bugs)eval()
/Function()
etc (since it is AOT)2c is Porffor's own Wasm -> C compiler, using generated Wasm bytecode and internal info to generate specific and efficient C code. Little boilerplate/preluded code or required external files, just for CLI binaries (not like wasm2c very much).
Porffor uses a unique versioning system, here's an example: 0.48.7
. Let's break it down:
0
- major, always 0
as Porffor is not ready yet48
- minor, total Test262 pass percentage (rounded half down, eg 49.4%
-> 48
, 49.5%
-> 49
)7
- micro, build number for that minor (incremented each git push)For the features it supports most of the time, Porffor is blazingly fast compared to most interpreters and common engines running without JIT. For those with JIT, it is usually slower by default, but can catch up with compiler arguments and typed input, even more so when compiling to native binaries.
compiler
: contains the compiler itself
builtins
: built-in apis written in typescript2c.js
: custom wasm-to-c engineassemble.js
: assembles wasm ops and metadata into a spec-compliant wasm module/filebuiltins.js
: all manually written built-ins of the engine (spec, custom. vars, funcs)builtins_precompiled.js
: generated builtins from the builtins/
foldercodegen.js
: code (wasm) generation, ast -> wasm. The bulk of the effortcyclone.js
: wasm partial constant evaluator (it is fast and dangerous hence "cyclone")disassemble.js
: wasm disassembler using internal debug infoencoding.js
: utils for encoding things as bytes as wasm expectsexpression.js
: mapping most operators to an opcode (advanced are as built-ins eg f64_%
)havoc.js
: wasm rewrite library (it wreaks havoc upon wasm bytecode hence "havoc")index.js
: doing all the compiler steps, takes code in, wasm outopt.js
: self-made wasm bytecode optimizerparse.js
: parser simply wrapping acorn (or other acorn-like parsers)pgo.js
: a profile guided optimizerprecompile.js
: the tool to generate builtins_precompied.js
prefs.js
: a utility to read command line argumentsprototype.js
: some builtin prototype functions (~legacy)types.js
: definitions for each of the builtin typeswasmSpec.js
: "enums"/info from wasm specwrap.js
: wrapper for compiler which instantiates and produces nice exportsruntime
: contains utils for running JS with the compiler
index.js
: the main file, you probably want to use thisrepl.js
: basic repl (uses node:repl
)test262
: test262 runner and utils
Currently, Porffor is seriously limited in features and functionality, however it has some key benefits:
Porffor intentionally does not use Wasm proposals which are not commonly implemented yet (eg GC) so it can be used in as many places as possible.
purple
in Welsh is porffor
. Why purple?
FAQs
An ahead-of-time JavaScript compiler
The npm package porffor receives a total of 349 weekly downloads. As such, porffor popularity was classified as not popular.
We found that porffor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.