
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
webassembly-loader
Advanced tools
Webpack loader for WebAssembly (like wasm-loader but have different export options)
this loader can also be used as a library ↙ see who use this?
tl;dr -- see examples

npm install webassembly-loader --save-dev
or
yarn add webassembly-loader --dev
exportHow wasm code would be exported. (see examples)
stringasyncbuffer will export wasm code as Buffermodule will export wasm code as WebAssembly.Moduleinstance will export wasm code as WebAssembly.Instanceasync will instantiate wasm code asynchronously, return promise of both WebAssembly.Module and WebAssembly.Instanceasync-module will compile wasm code asynchronously, return promise of WebAssembly.Moduleasync-instance will instantiate wasm code asynchronously, return promise of WebAssembly.Instancemodule.exports = {
rules: [{
test: /\.wasm$/,
type: "javascript/auto",
use: [{
loader: "webassembly-loader",
options: {
export: "async"
}
}]
}]
}
tips: you can use query parameter to change export mode on demand
See the test cases and example projects in *.test.ts and examples for more insight.
{export: 'buffer'}import wasmCode from "./lib.wasm";
WebAssembly.compile(wasmCode).then(module => {
const instance = new WebAssembly.Instance(module);
console(instance.exports.add(1, 2)); // 3
});
{export: 'module'}import wasmModule from "./lib.wasm";
const instance = new WebAssembly.Instance(wasmModule);
console(instance.exports.add(1, 2)); // 3
{export: 'instance'}import wasm from "./lib.wasm";
console(wasm.exports.add(1, 2)); // 3
{export: 'async'}import wasmInstantiate from "./lib.wasm";
wasmInstantiate(importObject | undefined).then(({ instance, module }) => {
console(instance.exports.add(1, 2)); // 3
// create different instance, extra will be called in different environment
const differentInstance = new WebAssembly.Instance(module);
console(differentInstance.exports.add(1, 2)); // 6
});
{export: 'async-instance'}import wasmInstantiate from "./lib.wasm";
wasmInstantiate(importObject | undefined).then(instance => {
console(instance.exports.add(1, 2)); // 3
});
{export: 'async-module'}import wasmInstantiate from "./lib.wasm";
wasmCompile(importObject | undefined).then(module => {
const differentInstance = new WebAssembly.Instance(module);
console(differentInstance.exports.add(1, 2)); // 3
});
FAQs
Webpack loader for WebAssembly (like wasm-loader but have different export options)
The npm package webassembly-loader receives a total of 88 weekly downloads. As such, webassembly-loader popularity was classified as not popular.
We found that webassembly-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.