
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
QJS adds an await keyword for use with Q promises. To use it, you must 'compile' your code. Unfortunately this somewhat destroy's your stack traces at the moment. I'd really like to come up with a way of repairing them. Other than that though, it's pretty much perfect.
PromisedMath.js
require('qjs').compile(module, function () {
//All your module code must go in here.
module.exports.add = function (a, b) {
return await(a) + await(b);
};
});
Consumer.js
var Q = require('q');
var math = require('./PromisedMath');
math.add(Q.delay(3, 5000), Q.delay(2, 5000)).then(console.log).end();
If you ran consumer.js, it would create a promise for 2 and a promise for 3. These promises both take 5 seconds to resolve (you could imagine them being pulled from a server). The add method recieves both promises and then waits (sequentially) for both to be resolved before adding them together. We then log the output of 5.
Because the time starts when we create the promise, it is not important that we then wait for them sequentially.
api.js
var Q = require('q');
var api = require('api');
module.exports.getNextMessage = Q.nbind(api.getNextMessage);
index.js
require('qjs').compile(module, function () {
//All your module code must go in here.
var api = require('./api');
function run() {
while (message = await(api.getNextMessage())) {
console.log(message);
}
};
});
The qjs library consists of a single function that compiles code that contains await into code that can run asyncronously. If any part of a module requires use of await like keywords, the whole module should be wrapped by the qjs compiler.
Inside the compiler you have access to await which will return the result of a promise, once it has been resolved. You also get access to Q which is the promise library and simply saves you putting var Q = require('q'); at the top of your file.
Please fork and update this project, it's very much a work in progress, but hopefully someone will find it useful.
I will accept pull requests that fix these, and I intend to fix all of them in the near future. In the mean time, if I find it and can't fix it I document it.
&& and || are not always as lazy as they should be if there's an await on the right hand side of the expression.FAQs
Use the await keyword with Q promises to tame your async code
We found that qjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.