
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Twig.js is a pure JavaScript implementation of the Twig PHP templating language (https://twig.symfony.com/)
The goal is to provide a library that is compatible with both browsers and server side JavaScript environments such as node.js.
Twig.js is currently a work in progress and supports a limited subset of the Twig templating language (with more coming).
Documentation is available in the twig.js wiki on Github.
For a list of supported tags/filters/functions/tests see the Implementation Notes page on the wiki.
Download the latest twig.js release from github: https://github.com/twigjs/twig.js/releases or via NPM:
npm install twig --save
A bower package is available from philsbury. Please direct any Bower support issues to that repo.
Include twig.js or twig.min.js in your page, then:
var template = Twig.twig({
data: 'The {{ baked_good }} is a lie.'
});
console.log(
template.render({baked_good: 'cupcake'})
);
// outputs: "The cupcake is a lie."
A loader is available from zimmo.be.
Tested on node >=6.0.
You can use twig in your app with
var Twig = require('twig'), // Twig module
twig = Twig.twig; // Render function
If you don't want to use Express, you can render a template with the following method:
import Twig from 'twig';
Twig.renderFile('./path/to/someFile.twig', {foo:'bar'}, (err, html) => {
html; // compiled string
});
Twig is compatible with express 2 and 3. You can create an express app using the twig.js templating language by setting the view engine to twig.
Express 3
var Twig = require("twig"),
express = require('express'),
app = express();
// This section is optional and used to configure twig.
app.set("twig options", {
allowAsync: true, // Allow asynchronous compiling
strict_variables: false
});
app.get('/', function(req, res){
res.render('index.twig', {
message : "Hello World"
});
});
app.listen(9999);
Message of the moment: <b>{{ message }}</b>
An Express 2 Example is available on the wiki.
If you have a change you want to make to twig.js, feel free to fork this repository and submit a pull request on Github. The source files are located in src/*.js.
twig.js is built by running npm run build
For more details on getting setup, see the contributing page on the wiki.
When developing on Windows, the repository must be checked out without automatic conversion of LF to CRLF. Failure to do so will cause tests that would otherwise pass on Linux or Mac to fail instead.
The twig.js tests are written in Mocha and can be invoked with npm test.
Twig.js is available under a BSD 2-Clause License, see the LICENSE file for more information.
See the LICENSES.md file for copies of the referenced licenses.
The JavaScript Array fills in src/twig.fills.js are from https://developer.mozilla.org/ and are available under the MIT License or are public domain.
The Date.format function in src/twig.lib.js is from http://jpaq.org/ and used under a MIT license.
The sprintf implementation in src/twig.lib.js used for the format filter is from http://www.diveintojavascript.com/projects/javascript-sprintf and used under a BSD 3-Clause License.
The strip_tags implementation in src/twig.lib.js used for the striptags filter is from http://phpjs.org/functions/strip_tags and used under and MIT License.
Nunjucks is a powerful templating engine for JavaScript, inspired by Jinja2 (Python) and Twig (PHP). It offers similar features such as template inheritance, custom filters, and asynchronous rendering. Nunjucks is known for its flexibility and ease of use, making it a popular choice for JavaScript developers.
Handlebars is a popular templating engine that provides a simple and intuitive syntax for creating dynamic templates. It supports features like template partials, helpers, and custom expressions. Handlebars is known for its performance and is widely used in both client-side and server-side applications.
EJS (Embedded JavaScript) is a templating engine that allows you to generate HTML markup with plain JavaScript. It supports features like template partials, custom filters, and includes. EJS is known for its simplicity and ease of integration with Express.js and other Node.js frameworks.
FAQs
JS port of the Twig templating language.
The npm package twig receives a total of 479,388 weekly downloads. As such, twig popularity was classified as popular.
We found that twig demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.