
Security News
OpenClaw Skill Marketplace Emerges as Active Malware Vector
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.
rescript-bun
Advanced tools
Use Bun with ReScript.
Currently alpha state software. You're encouraged to start using it, but please report all issues. There will be both bindings missing and some bindings will probably be wrong/suboptimal. We're going to work through the API surface as we go. Report all issues you find!
Template repo to get up and running quickly: https://github.com/zth/rescript-bun-starter
You need to be on ReScript v11 >=11.1.0 and Core >=1.3.0. This is designed for uncurried mode so you should use that as well ("uncurried": true in your bsconfig/rescript.json).
Install rescript-bun and @rescript/core:
npm i rescript-bun @rescript/core
Include them in your rescript.json:
{
"bs-dependencies": ["@rescript/core", "rescript-bun"]
}
rescript-bun is namespaced, so you'll find all modules listed under the main module RescriptBun.
You're strongly encouraged to open RescriptBun globally, to get the best possible developer experience. You do that by adding this to your rescript.json:
{
"bsc-flags": [
"-open RescriptCore",
"-open RescriptBun",
"-open RescriptBun.Globals"
]
}
Notice
-open RescriptBun.Globals. This will expose all Bun globals. This might be a matter of taste, but I recommend opening it to get the best experience.
This will make all of Bun available to you without needing to dip into the RescriptBun module explicitly.
This lib copies rescript-nodejs for Bun's Node compatible bindings. Shout out to the maintainers of that project!
Here's a few examples of how it looks. More examples (often inspired by https://bun.sh/guides) can be found in the playground/examples directory in this repo.
To write tests using Bun's built in test runner, just open Test and you'll have everything available to you to write your tests:
open Test
describe("Playing around with tests", () => {
test("addition works", () => {
expect(1 + 1)->Expect.toBe(2)
})
})
This will make all of Bun's testing utilities available to you in the global scope.
Here's setting up a simple web server.
let server = Bun.serve({
fetch: async (request, _server) => {
let userName =
request
->Request.headers
->Headers.get("x-user-name")
->Option.getWithDefault("Unknown user")
Response.make(`Hello ${userName}!`, ~options={status: 200})
},
})
let port =
server
->Bun.Server.port
->Int.toString
let hostName = server->Bun.Server.hostname
Console.log(`Server listening on http://${hostName}:${port}!`)
let password = "super-secure-pa$$word"
let bcryptHash = await Bun.Password.hash(
password,
~algorithm=BCryptAlgorithm({
cost: 4, // number between 4-31
}),
)
let isMatch = await Bun.Password.verify(password, ~hash)
let router = Bun.FileSystemRouter.make({
style: NextJs,
dir: "./pages",
origin: "https://mydomain.com",
assetPrefix: "_next/static/",
})
let matches = router->Bun.FileSystemRouter.match("/")
// Rewrite all <div> to <section>
let rewriter = HTMLRewriter.make()->HTMLRewriter.on(
"*",
{
element: element => {
if element.tagName === "div" {
element.tagName = "section"
}
},
},
)
let response = await fetch("https://bun.sh")
let transformedResponse = rewriter->HTMLRewriter.transform(response)
let html = await transformedResponse->Response.text
Console.log(html)
Currently, bindings exist for the most common things. There's still a good amount of bindings missing. Some bindings will be covered as we go along, while others won't be added.
rescript-webapi instead of rolling our own bindings. I've intentionally not reused any other existing library because I wanted to start from scratch and follow ReScript v11 idioms as much as possible. But once all of this settles, we need to figure out and share the common denominator with rescript-webapi and other similar projects to this.Contributions are very welcome. We're aiming to cover close to 100% of the Bun API surface, which is quite huge task. But, it's definitively possible and the initial large effort pays dividends over time.
If you do want to contribute, please open an issue saying you're starting work on module X. So we don't accidentally double work.
This will be fleshed out in a short while.
FAQs
Use Bun with ReScript.
The npm package rescript-bun receives a total of 211 weekly downloads. As such, rescript-bun popularity was classified as not popular.
We found that rescript-bun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Security researchers report widespread abuse of OpenClaw skills to deliver info-stealing malware, exposing a new supply chain risk as agent ecosystems scale.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.