
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Experimental Proof of concept web framework using wasm components. All input and UI generation is done in Wasm, so there cannot be "call home" vulnerabilities over your data inputs. This means you can use guest Apps (wasm components) in a trustless fashion in your host app.
Wurbo? Like Turbo, but using Wasm Components. Kind of like Elm too? Render HTML from wasm ui components.
examples/vowelsexamples/formssrc/routes/+page.svelteTo run the examples locally in the browser, you can use the following commands:
# build-component:
cargo component build --workspace
# prev: build-component
npm run build && npm run preview -- --open
or using just: just prev
The example is demonstrated at https://douganderson444.github.io/wurbo
reactivity with functions render and activateimports) with function addeventlistenercargo component new --reactor <name>render crate to your Cargo.toml dependenciesuse the wurbo crate's macro to implement the reactivity interface for reactivity::Guest.Page parent component and Input / Output components as you like for your user interface.load the wasm bytes + importables into an ES module (called it mod) using rollup-plugin-wit-componentmod.reactivity.render(args) uses that module to load the initial data.wurbo.listen(mod) listens for events from the componentmod.reactivity.activate() once the DOM has loaded, to start listening for change events.Table Summary:
| Step | WIT | Rust | JavaScript |
|---|---|---|---|
| 1 | declare interface imports | pass imports to wurbo macro | implement imports as JS code then pass stringified code to rollup-plugin-wit-component fn load via importables |
| 2 | declare interface reactivity | implement interface reactvity using the macro and your render crate Components | load reactivity ES module using rollup-plugin-wit-component |
| 3 | Ready. | call cargo component build --release | call mod.reactivity.render(args) to get rendered HTML |
| 4 | Ready. | Ready. | call wurbo.listen(mod) to set up listeners |
| 5 | Ready. | Ready. | When DOM has loaded the rendered HTML, then call mod.reactivity.activate() to actually listen |
Once you've created a project and installed dependencies with npm install (or pnpm install or yarn), start a development server:
Compile the wasm component, see README.md for more details.
npm run build
# or start the server and open the app in a new browser tab
npm run preview -- --open
To build the code (dev mode does not work due to how Vite handles wasm):
cargo component build --workspace --release
npm run build
You can preview the production build with npm run preview.
To deploy your app, you may need to install an adapter for your target environment.
To publish to npm:
just publish
or, manually:
npm run package
npm publish
To publish to crates.io:
cargo publish -p wurbo
FAQs
A tiny front-end framework for webassembly components
We found that wurbo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.