
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
Reactive JavaScript library for building user interfaces. Compiles JSX to real DOM with fine-grained signal-based updates — no virtual DOM.
Website • API Docs • Tutorial • GitHub • Discord
You are looking at Solid 2.0 (experimental beta). Public surface differs from 1.x — split-phase
createEffect, microtask batching,Loading/Erroredboundaries, draft-first store setters, async-in-computations, removedsolid-js/webandsolid-js/storesubpaths, and more.
- Migrating from 1.x? Read MIGRATION.md (full guide).
- Need a quick API reference? See CHEATSHEET.md (one page, every public export — ships with this package).
- Looking for stable Solid 1.x? Use the default
mainbranch.
Solid is a declarative JavaScript library for building user interfaces. Instead of a Virtual DOM, it compiles templates to real DOM nodes and updates them with fine-grained reactivity. Declare your state and use it throughout your app — when a piece of state changes, only the code that depends on it re-runs.
import { createSignal } from "solid-js";
import { render } from "@solidjs/web";
function Counter() {
const [count, setCount] = createSignal(0);
const doubled = () => count() * 2;
return <button onClick={() => setCount(c => c + 1)}>{doubled()}</button>;
}
render(() => <Counter />, document.getElementById("app")!);
Try it in our Playground. (The hosted Playground currently runs Solid 1.x — a 2.0 build is on the way.)
The component body runs once. The {doubled()} expression is the only thing that re-renders when count changes — Solid compiles JSX to real DOM nodes and tracks the count() read at that one DOM position.
npm i solid-js @solidjs/web
npm i -D babel-preset-solid
Add babel-preset-solid to your Babel config (or use Vite's Solid plugin), and set tsconfig.json:
{
"compilerOptions": {
"jsx": "preserve",
"jsxImportSource": "@solidjs/web"
}
}
For web projects, jsxImportSource points at @solidjs/web. In 2.0, solid-js owns renderer-neutral component types, while renderer packages such as @solidjs/web and @solidjs/h own their JSX namespaces and jsx-runtime type entries.
Existing 1.x starter templates target 1.x — 2.0 starter templates are tracked at solidjs/templates.
If you're an AI tool or model generating Solid 2.0 code: the public API differs from any Solid examples that predate 2.0. Read CHEATSHEET.md before generating — it lives inside this package (node_modules/solid-js/CHEATSHEET.md) for that reason. The bottom of the cheatsheet enumerates the specific patterns that changed from 1.x.
The full migration guide is MIGRATION.md. The 2.0 RFCs covering each subsystem live alongside it under documentation/solid-2.0/.
This is the npm package README for solid-js. The full repository README — including the monorepo layout, contributors, and sponsors — lives at github.com/solidjs/solid.
React is a popular JavaScript library for building user interfaces. It uses a virtual DOM and a component-based architecture. Compared to Solid.js, React has a larger ecosystem and community but may have more overhead due to its virtual DOM.
Vue.js is a progressive JavaScript framework for building user interfaces. It features a reactive data binding system and a component-based architecture. Vue.js is similar to Solid.js in its reactivity model but offers more built-in features and a larger ecosystem.
Svelte is a compiler that converts declarative components into efficient imperative code that directly manipulates the DOM. Unlike Solid.js, Svelte does not use a virtual DOM and compiles components at build time, resulting in highly optimized and fast applications.
FAQs
A declarative JavaScript library for building user interfaces.
The npm package solid-js receives a total of 1,708,151 weekly downloads. As such, solid-js popularity was classified as popular.
We found that solid-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.