
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A minimal graphics library inspired by three.js written in Rust, compiled to wasm in order to be as fast as possible in the browser. Initially rendered via WebGL with an eye towards WebGPU and modern browser developments. Currently probably slower than using webgl directly from js (see Future section)
npm install webgfx
<html>
<body>
<script module="">
<canvas id="canvas"></canvas>
</body>
</html>
import { BoxGeometry, Mesh, MeshBasicMaterial, PerspectiveCamera, Renderer, Scene } from 'webgfx';
// 1. Build the Scene
const geometry = new BoxGeometry(1, 1, 1);
const material = new MeshBasicMaterial();
const cube = new Mesh(geometry, material);
const scene = new Scene();
scene.add(cube);
// 2. Render the Scene statically (not in an animation loop)
const camera = new PerspectiveCamera();
const canvas = document.getElementById('canvas');
const renderer = new WebGLRenderer({ canvas });
renderer.render(scene, camera);
This library probably isn't usable until the following are implemented fully:
Wasm Host Bindings
allow RUST to talk directly to Web APIs without the overhead of making js shims. Allow garbage collection to work in Javascript so don't have to manually free Rust created objects.
WebGPU
This is a new spec that dramatically decreases the CPU overhead of sending a scene to the GPU. WebGL is a deprecated API that only allows for a small number of calls in each frame. Until this is official, will be rendered as WebGL.
FAQs
Graphics engine for the web
The npm package webgfx receives a total of 1 weekly downloads. As such, webgfx popularity was classified as not popular.
We found that webgfx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.