
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
Reactive JavaScript library for building user interfaces. Compiles JSX to real DOM with fine-grained signal-based updates — no virtual DOM.
Website • API Docs • Tutorial • GitHub • Discord
You are looking at Solid 2.0 (experimental beta). Public surface differs from 1.x — split-phase
createEffect, microtask batching,Loading/Erroredboundaries, draft-first store setters, async-in-computations, removedsolid-js/webandsolid-js/storesubpaths, and more.
- Migrating from 1.x? Read MIGRATION.md (full guide).
- Need a quick API reference? See CHEATSHEET.md (one page, every public export — ships with this package).
- Looking for stable Solid 1.x? Use the default
mainbranch.
Solid is a declarative JavaScript library for building user interfaces. Instead of a Virtual DOM, it compiles templates to real DOM nodes and updates them with fine-grained reactivity. Declare your state and use it throughout your app — when a piece of state changes, only the code that depends on it re-runs.
import { createSignal } from "solid-js";
import { render } from "@solidjs/web";
function Counter() {
const [count, setCount] = createSignal(0);
const doubled = () => count() * 2;
return (
<button onClick={() => setCount(c => c + 1)}>
{doubled()}
</button>
);
}
render(() => <Counter />, document.getElementById("app")!);
Try it in our Playground. (The hosted Playground currently runs Solid 1.x — a 2.0 build is on the way.)
The component body runs once. The {doubled()} expression is the only thing that re-renders when count changes — Solid compiles JSX to real DOM nodes and tracks the count() read at that one DOM position.
npm i solid-js @solidjs/web
npm i -D babel-preset-solid
Add babel-preset-solid to your Babel config (or use Vite's Solid plugin), and set tsconfig.json:
{
"compilerOptions": {
"jsx": "preserve",
"jsxImportSource": "solid-js"
}
}
Existing 1.x starter templates target 1.x — 2.0 starter templates are tracked at solidjs/templates.
If you're an AI tool or model generating Solid 2.0 code: the public API differs from any Solid examples that predate 2.0. Read CHEATSHEET.md before generating — it lives inside this package (node_modules/solid-js/CHEATSHEET.md) for that reason. The bottom of the cheatsheet enumerates the specific patterns that changed from 1.x.
The full migration guide is MIGRATION.md. Eight RFCs covering each subsystem (reactivity, control flow, stores, async, actions, DOM, dev-mode diagnostics) live alongside it under documentation/solid-2.0/.
This is the npm package README for solid-js. The full repository README — including the monorepo layout, contributors, and sponsors — lives at github.com/solidjs/solid.
React is a popular JavaScript library for building user interfaces. It uses a virtual DOM and a component-based architecture. Compared to Solid.js, React has a larger ecosystem and community but may have more overhead due to its virtual DOM.
Vue.js is a progressive JavaScript framework for building user interfaces. It features a reactive data binding system and a component-based architecture. Vue.js is similar to Solid.js in its reactivity model but offers more built-in features and a larger ecosystem.
Svelte is a compiler that converts declarative components into efficient imperative code that directly manipulates the DOM. Unlike Solid.js, Svelte does not use a virtual DOM and compiles components at build time, resulting in highly optimized and fast applications.
FAQs
A declarative JavaScript library for building user interfaces.
The npm package solid-js receives a total of 1,666,782 weekly downloads. As such, solid-js popularity was classified as popular.
We found that solid-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.