
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
runtime.js is an open-source library operating system (unikernel) for the cloud that runs JavaScript, can be bundled up with an application and deployed as a lightweight and immutable VM image.
It's built on V8 JavaScript engine and uses event-driven and non-blocking I/O model inspired by Node.js. At the moment KVM is the only supported hypervisor.
It tries to be compatible with npm module ecosystem and supports some of the Node.js API.
WARNING: project is in development and not ready for production use.
First thing is the command line tool runtime-cli, it will add runtime command to the shell. Type runtime to get full usage help.
npm install runtime-cli -g
Make sure QEMU is installed, it enables running applications locally.
brew install qemu # OSX
sudo apt-get install qemu # Ubuntu
Create new project and add index.js entry point file:
mkdir project
cd project
npm init
npm install runtimejs --save
echo "console.log('ok')" > index.js
Run project locally in QEMU:
runtime start
That's it, it should start and print ok in the console.
Optionally you can let it watch directory for changes and restart QEMU automatically:
runtime watch
There are two main components: operating system kernel and a JavaScript library.
The kernel is written in C++ and manages low-level resources like CPU and memory, runs JavaScript using embedded V8 engine. Library drives the entire system and manages hardware devices (usually virtualized by hypervisor).
Modules and projects developed by the community for runtime.js
Apache License, Version 2.0
FAQs
Core runtime.js library
We found that runtimejs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.