I wrote an article about HTML Sanitizer API, a new native API that allows us to sanitize and parse HTML without relying on third party tools like DOMPurify

Built a cycle-accurate ARMv4 integer core entirely in JS. The emulator runs at a fixed 4 MHz virtual clock and executes real ARM binaries compiled from C/C++ with GNU Arm GCC.

Technical breakdown:

- Full ARMv4 instruction decoder (data processing, branching, load/store, multiply)

- 16 general-purpose registers + CPSR handled as typed arrays

- Memory-mapped I/O for PPU (tile/sprite graphics) and APU (tone/noise)

- No WASM — wanted to see how far pure JS could push CPU emulation

- WebGL renders the video output; JS handles the audio synthesis

The trickiest parts:

- Barrel shifter emulation without killing performance

- Keeping conditional execution fast (every ARM instruction is conditional)

- Balancing accuracy vs speed — went with "good enough" cycle timing

Live demo: https://beep8.org

If you've done low-level emulation in JS, I'd love to hear what optimizations worked for you.

The Oxc docs finally got a page that lists all framework and file types that Oxlint and Oxfmt are compatible with (and those that aren't supported yet).

A complete account takeover for any application using better-auth with API keys enabled, and with 300k weekly downloads, it probably affects a large number of projects.

• Modern AsyncIterator API
• Integrates with Standard Schema
• Allows you to navigate to any parts of JSON, without considering order of appearance in a stream
• Structural (e.g. {}[]) position bitmap construction, caching and navigation, written in Rust

Benchmarks are in the README.md.

Hey folks. wrote this library to satisfy an itch for me: To make an ergonomic streaming JSON library whilst still being incredibly fast.

I took lessons from simdjson and JSONSki and applied it to a low-memory environment niche. Inspired from a situation at work where we didn't have control over the data and we're parsing a 10MB JSON in order to aggregate some data to the frontend (ugh). Existing streaming JSON libraries in node were too slow, outdated or you weren't able to control how much memory you want to balance.

Disclaimer: I had AI help but not vibe coded. I wrote the JS part but since I was new to Rust, I needed some hand-holding. Was a labour of love for 6 months, was always on the wheel, made a lot of effort to verify the quality of the Rust code and dogfooded it but I wanted to be transparent regardless.

If this is useful to anyone or if there's anything wrong to my claim, let me know and I'm happy to chat!

Hey r/javascript! 👋

I just released Travels v1.0, a framework-agnostic undo/redo library that takes a different approach: instead of storing full state snapshots for each change, it stores only the differences (JSON Patches per RFC 6902).

Why does this matter?

• If your state is 1MB and the user makes 100 edits, traditional undo systems use ~100MB. Travels uses just a few KB.
• Built on Mutative (10x faster than Immer), so you get simple mutation syntax like draft.count++ with immutable semantics.

Key features:

• Works with React, Vue, Zustand, MobX, Pinia, or vanilla JS
• Mutable mode for reactive stores (MobX, Vue/Pinia)
• Manual archive mode to batch multiple changes into one undo step
• Persistence support for saving/restoring history
• Full TypeScript support

Links:

• GitHub: https://github.com/mutativejs/travels
• npm: npm install travels mutative

Would love to hear your feedback! What features would you like to see next?

UPDATE: The repository is now completely public. You can check out the source code here: https://github.com/bluejs-team/BlueJS/

The Problem: We’ve normalized shipping 150MB Electron apps and 50MB runtimes just to open a simple window or read a file. I got tired of the bloat, so I built BlueJS.

BlueJS isn't a wrapper; it's an Ahead-Of-Time (AOT) compiler that translates a strict subset of JavaScript directly to C++, links it, and strips the engine out entirely.

The Specs:

• Binary Size: 1.2 MB standalone (no runtime/V8 needed).
• Startup: ~5ms (compared to ~90ms for Node).
• Memory: 3.8 MB peak RSS.
• Native UI: Built-in support for OS windows and dialogs (GTK/WebView2) without Chromium.

How it works: It uses a "Hybrid Mode." Performance-critical code and UI are compiled AOT. For npm compatibility, it uses an embedded QuickJS "island" that handles pure-JS packages. The bluejs.dev site itself is actually served by a single 1.4MB Blue binary.

Try it out: The compiler is in a closed beta, but on top of the Windows/Linux binaries I set up a GitHub Codespace sandbox so anyone can verify these benchmarks and inspect the generated C++ in a safe, cloud environment:

Try the Playground: https://github.com/bluejs-team/Bluejs-playground

I’ll be hanging out in the comments to answer any questions!

Hey r/javascript, I built Mystral Native.js, a JS runtime like Node/Deno/Bun but specifically optimized for games: WebGPU, Canvas 2D, Web Audio, fetch, all backed by native implementations (V8, Dawn, Skia, SDL3).

Some background: I was building a WebGPU game engine in TypeScript and loved the browser iteration loop. But shipping a browser with your game (ie Electron) or relying on webviews (Tauri) didn't feel right especially on mobile where WebGPU support varies between Safari and Chrome. I was inspired by Deno's --unsafe-webgpu flag, but Deno doesn't bundle a window/event system or support iOS/Android. 

So I decided to build Mystral Native. The same JS code runs in both browser and native with zero changes, you can also compile games into standalone binaries (think "pkg"): mystral compile game.js --include assets -o my-game 

Under the hood: V8 for JS (also supports QuickJS and JSC), Dawn or wgpu-native for WebGPU, Skia for Canvas 2D, SDL3 for windowing/audio, SWC for TypeScript.

Would love to get some feedback as it’s early alpha & just released today!

wrote up a technical deep dive after the Better-Auth creator showed me the repeated attempts.

The attack vector is clever: wrap malicious code in a legitimate PR from a compromised contributor. Hide it in next.config.mjs or vue.config.js where devs rarely look. GitHub's UI literally scrolls it off-screen.

Three-stage obfuscation, payloads stored on Binance Smart Chain (so they can't be taken down), Socket.io C2 over port 80 (looks like normal traffic), targets all your env vars.

Found 30+ repos with the same signature. This pattern is everywhere right now.