
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
pxt-core
Advanced tools
Microsoft MakeCode is based on the open source project Microsoft Programming Experience Toolkit (PXT). Microsoft MakeCode is the name in the user-facing editors, PXT is used in all the GitHub sources.
PXT is a framework for creating special-purpose programming experiences for beginners, especially focused on computer science education. PXT's underlying programming language is a subset of TypeScript (leaving out JavaScript dynamic features).
The main features of PXT are:
More info:
Examples of Editors built with MakeCode:
master is the active development branch, currently v3.* buildsv* is the servicing branch for v*.* buildsPlease follow the instructions here.
If you are modifying your own instance of PXT and want a target (such as pxt-microbit) to use your local version, cd to the directory of the target (pxt-microbit, in our example, which should be a directory sibling of pxt) and perform
pxt link ../pxt
If you have multiple checkouts of pxt, you can do the following:
npm i in pxt and the targetpxt link ..\some-other-pxt (you may need to update your CLI first by running npm install -g pxt)If you run npm i afterwards (in either the target or pxt), you might need to repeat these steps.
First, install Node: minimum version 8.
To build the PXT command line tools:
npm install
npm run build
Then install the pxt command line tool (only need to do it once):
npm install -g pxt
After this you can run pxt from anywhere within the build tree.
To start the local web server, run pxt serve from within the root
of an app target (e.g. pxt-microbit). PXT will open the editor in your default web browser.
If you are developing against pxt, you can run gulp watch from within the root of the
pxt repository to watch for changes and rebuild.
gulp watch
If you are working on the CLI exclusively,
gulp watchCli
There are a number of custom icons (to use in addition
to http://semantic-ui.com/elements/icon.html) in the svgicons/ directory.
These need to be 1000x1000px. Best start with an existing one. To see available icons go to
http://localhost:3232/icons.html (this file, along with icons.css containing
the generated WOFF icon font, is created during build).
If you're having trouble with display of the icon you created, try:
npm install -g svgo
svgo svgicons/myicon.svg
In the documentation, highlighting of code snippets uses highlight.js (hljs). Currently, the following languages are included:
If you need to add other languages or update existing ones,
you can find the distribution at https://highlightjs.org/download/;
select all the languages you want to include (including the ones above!),
download and unzip,
and finally copy over highlight.pack.js into webapp/public/highlight.js/.
The tests are located in the tests/ subdirectory and are a combination of node and
browser tests. To execute them, run npm run test:all in the root directory.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
MICROSOFT, the Microsoft Logo, and MAKECODE are registered trademarks of Microsoft Corporation. They can only be used for the purposes described in and in accordance with Microsoft’s Trademark and Brand guidelines published at https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general.aspx. If the use is not covered in Microsoft’s published guidelines or you are not sure, please consult your legal counsel or MakeCode team (makecode@microsoft.com).
FAQs
Microsoft MakeCode provides Blocks / JavaScript / Python tools and editors
The npm package pxt-core receives a total of 8,111 weekly downloads. As such, pxt-core popularity was classified as popular.
We found that pxt-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.