Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
stockfish.wasm
Advanced tools
WebAssembly port of the strong chess engine Stockfish. See it in action on https://lichess.org/analysis.
This port is branched from SF_classical
.
See https://github.com/hi-ogawa/Stockfish for a WebAssembly port with NNUE support.
Uses the latest WebAssembly threading proposal. Requires these HTTP headers on the top level response:
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
And the following header on the included files:
Cross-Origin-Embedder-Policy: require-corp
chrome://flags/#enable-webassembly-threads
or
Origin Trial.javascript.options.shared_memory
and dom.postMessage.sharedArrayBuffer.withCOOP_COEP
to be enabled in about:flags
.javascript.options.shared_memory
to be enabled in about:flags
No support.
See stockfish.js for a more portable but single-threaded version.
function wasmThreadsSupported() {
// WebAssembly 1.0
const source = Uint8Array.of(0x0, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00);
if (
typeof WebAssembly !== "object" ||
typeof WebAssembly.validate !== "function"
)
return false;
if (!WebAssembly.validate(source)) return false;
// SharedArrayBuffer
if (typeof SharedArrayBuffer !== "function") return false;
// Atomics
if (typeof Atomics !== "object") return false;
// Shared memory
const mem = new WebAssembly.Memory({ shared: true, initial: 8, maximum: 16 });
if (!(mem.buffer instanceof SharedArrayBuffer)) return false;
// Structured cloning
try {
// You have to make sure nobody cares about these messages!
window.postMessage(mem, "*");
} catch (e) {
return false;
}
// Growable shared memory (optional)
try {
mem.grow(8);
} catch (e) {
return false;
}
return true;
}
navigator.deviceMemory
before allocating.navigator.hardwareConcurrency
.
May be capped lower (e.g., dom.workers.maxPerDomain
in Firefox).Assuming em++ (^2.0.13
) is available:
npm run-script prepare
Requires stockfish.js
, stockfish.wasm
and stockfish.worker.js
(total size ~400K, ~150K gzipped) to be served from the same directory.
<script src="stockfish.js"></script>
<script>
Stockfish().then((sf) => {
sf.addMessageListener((line) => {
console.log(line);
});
sf.postMessage("uci");
});
</script>
Or from recent node (v14.4.0 tested) with flags
--experimental-wasm-threads --experimental-wasm-bulk-memory
:
const Stockfish = require("stockfish.wasm"); // the module, not the file
Stockfish().then((sf) => {
// ...
});
Thanks to the Stockfish team for sharing the engine under the GPL3.
FAQs
WebAssembly port of the strong chess engine Stockfish
We found that stockfish.wasm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.