
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
weavatrix-graph
Advanced tools
Deterministic, evidence-carrying Rust graph core for Node.js and Bun
The evidence graph behind Weavatrix, available as an independent native product for Node.js and Bun.
It combines deterministic topology with stable identities, typed relations, provenance, confidence, source spans, canonical serialization, and production graph algorithms. This is the Rust weavatrix-graph core through Node-API—not a JavaScript rewrite and not an MCP server.
npm install weavatrix-graph
# or
bun add weavatrix-graph
const { Graph } = require('weavatrix-graph')
const graph = new Graph({
nodes: [
{ id: 'api', label: 'API', kind: 'service' },
{ id: 'db', label: 'Database', kind: 'table' },
],
edges: [{
source: 'api',
target: 'db',
kind: 'reads',
provenance: {
extractor: 'architecture',
evidence: 'parsed',
confidence: 'exact',
},
}],
})
console.log(graph.shortestPath('api', 'db'))
console.log(graph.stronglyConnectedComponents())
console.log(graph.pageRank())
The first native surface includes validated canonical graphs, incoming and outgoing evidence, BFS, shortest paths, strongly connected components, cycle detection, topological sort, PageRank, and deterministic DOT. The Rust product also owns the broader algorithm suite used by repository intelligence and architecture tooling.
Equal-output contract: materialize the same directed-BFS node IDs on 50,000 nodes and 149,991 edges. Windows x64 medians after two warmups, with execution order alternated per round:
| Runtime | Weavatrix | Graphology 0.26.0 | Result |
|---|---|---|---|
| Node 24.15.0 | 12.813 ms | 37.267 ms | 2.91x faster |
| Bun 1.4.0 | 9.105 ms | 24.001 ms | 2.64x faster |
At ten nodes both sides fall into roughly 0.004-0.006 ms timer noise, so the project does not claim a small-graph winner. See the full report, parity rule, caveats, and reproduction commands.
One npm package supports Node.js 18+ and Bun 1.4+. Optional native packages cover Windows, macOS, and glibc Linux on x64 and arm64. The Node-API 8 ABI keeps the addon independent of a single Node major version.
Graph owns its repository, package, release evidence, and MIT license. It can be used independently of every other Weavatrix product.
Repository: Weavatrix/weavatrix-graph · Rust crate: crates.io/crates/weavatrix-graph · License: MIT
FAQs
Deterministic, evidence-carrying Rust graph core for Node.js and Bun
The npm package weavatrix-graph receives a total of 12 weekly downloads. As such, weavatrix-graph popularity was classified as not popular.
We found that weavatrix-graph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.