Alternatives
Products that do what Regolith – Regex library that prevents ReDoS CVEs in TypeScript does
I wanted a safer alternative to RegExp for TypeScript that uses a linear-time engine, so I built Regolith. Why: Many CVEs happen because TypeScript libraries are vulnerable to Regular Expression Denial of Service attacks. I learned about this problem while doing undergraduate research and found that languages like Rust have built-in protection but languages like JavaScript, TypeScript, and Python do not. This library attempts to mitigate these vulnerabilities for TypeScript and JavaScript. How: Regolith uses Rust's Regex library under the hood to prevent ReDoS attacks. The Rust Regex library…
- 1
- 2AM
I made an open source, MIT license Typescript library based on some of the latest research that generates prompt injection attacks. It is a super minimal/lightweight and designed to be super easy to use. Keen to hear your thoughts and please be responsible and only pen test systems where you have permission to pen test!
2025 · prompt-injector.blueprintlab.io
- 3EJ
This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…
2024 · github.com
- 4CA
2024 · docs.rs
- 5CA
We've been building Crust (https://crustjs.com/), a TypeScript-first, Bun-native CLI framework with zero dependencies. It's been powering our core product internally for a while, and we're now open-sourcing it. The problem we kept running into: existing CLI frameworks in the JS ecosystem are either minimal arg parsers where you wire everything yourself, or heavyweight frameworks with large dependency trees and Node-era assumptions. We wanted something in between. What Crust does differently: - Full type inference from definitions — args and flags are inferred automatically. No…
Mar 2026 · github.com
- 6SA
I've been working on Shelgon, a framework that lets you build your own custom REPL shells and interactive CLI applications in Rust. You can use Shelgon to: - Create a custom shell with only a few lines of code - Build interactive debugging tools with persistent state between commands - Develop domain-specific language interpreters with shell-like interfaces - Add REPL capabilities to existing applications Getting started is straightforward - implement a single trait that handles your command execution logic, and Shelgon takes care of the terminal UI, input handling, and async runtime…
2025 · github.com
- 7RL
We've been building data pipelines that scrape websites and extract structured data for a while now. If you've done this, you know the drill: you write CSS selectors, the site changes its layout, everything breaks at 2am, and you spend your morning rewriting parsers. LLMs seemed like the obvious fix — just throw the HTML at GPT and ask for JSON. Except in practice, it's more painful than that: - Raw HTML is full of nav bars, footers, and tracking junk that eats your token budget. A typical product page is 80% noise. - LLMs return malformed JSON more often than you'd expect, especially with…
Mar 2026 · github.com
- 8SS
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev
- 9CA
The most comprehensive authentication library for TypeScript
2024 · github.com
- 10DT
Hi HN - Peter from DBOS here with my co-founder Qian (qianl_cs) Today we want to share our TypeScript library for lightweight durable execution. We’ve been working on it since last year and recently released v2.0 with a ton of new features and major API overhaul. https://github.com/dbos-inc/dbos-transact-ts Durable execution means persisting the execution state of your program while it runs, so if it is ever interrupted or crashes, it automatically resumes from where it left off. Durable execution is useful for a lot of things: - Orchestrating long-running or…
2025 · github.com
- 11TS
Hi HN, I’m Guillaume, the cofounder of Bearer, an Open Source SAST solution. After launching a few weeks ago here on Hacker News with support for Ruby and JavaScript stacks, I’m happy to report we’ve just released a new version (v1.2) with TypeScript support! In terms of code coverage, we use the same rules already implemented for vanilla JavaScript, but as usual, you can build your own. The rules list is here: https://docs.bearer.com/reference/rules/ It’s a first version for TS, but we believe that thanks to the pre-existing JavaScript support it should already…
2023
- 12BB
This is a simple single-file python program that can find basic XSS (cross-site scripting) vulnerabilities in a target url. Most XSS discovery tools use a payload refelection strategy in which payloads are injected in url parameters and the GET response is inspected for places where the payload content is reflected. This is a very low precision XSS detection strategy because most reflection does not support execution. This program uses a different approach, and instead opens the target url in a browser, tests alert(...) payloads directly in the browser context, and listens for an alert being…
2024 · github.com
- 13AS
Took a stab at building my own string diffing JS package. I built an interactive demo for TypeIt’s website (https://typeitjs.com/build-your-own) a while back. The approach I took to handle user input necessitated a way to calculate the difference between the versions of a user’s text input. I searched around for a package to help me out and found a couple of good ones (like fast-diff), but I either didn’t really like their API or didn’t want to take on a huge new dependency. Instead, I thought I’d give it a shot myself (famous last words). I dove into it having no real formal…
2022
- 14IB
BoringSSL and nghttp2. Matches JA3N, JA4, and JA4_R fingerprints. Supports HTTP/2, async/await, and works with Cloudflare-protected sites. Not trying to compete with curl_cffi - just a learning project that turned into something functional.
Nov 2025 · github.com
- 15PT
Throughout my career, I tried many tools to query PostgreSQL, and in the end, concluded that for what I do, the simplest is almost always the best: raw SQL queries. Until now, I typed the results manually and relied on tests to catch problems. While this is OK in e.g., GoLang, it is quite annoying in TypeScript. First, because of the more powerful type system (it's easier to guess that updated_at is a date than it is to guess whether it's nullable or not), second, because of idiosyncrasies (INT4s are deserialised as JS numbers, but INT8s are deserialised as strings). So I wrote pg-typesafe,…
Feb 2026 · github.com
- 16AP
2022 · github.com
- 17SU
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Feb 2026 · github.com
- 18HT
Hey everyone! I've been working on hsrs, a type-safe Haskell Bindings Generator for Rust. I couldn't really find any bindings generator that would create type-safe, rich bindings for Haskell from Rust. Naturally, both languages have rich type systems, so I was amazed that no awesome bindings generator already existed, hence I decided to write my own. hsrs feels very similar to pyo3 and napi-rs, and if you've used those, hsrs will feel right at home. What's unique about hsrs as opposed to hs-bindgen is that it has type-safe bindings for rich types, like Result, Maybe, etc. while also…
May 2026 · github.com
- 19IR
I built Morph, an experimental fullstack HTML-first library for Deno, Node, and Bun. Everything returns HTML, not JSON. No React, no Vite — just plain HTML with server-side rendering. No build steps, no preprocessors, no complex configs — everything runs from a single file. Perfect for Telegram Web Apps, internal tools, simple admin panels, dashboards, or anywhere a full-blown SPA feels like overkill. Important: I built this entirely for myself — to solve my own problems. I hate complex frontend. I hate writing it. And I don’t want to waste time on it. But maybe it’ll help you too.
2025 · github.com
- 20CR
I've created cppmatch, a lightweight, header-only C++ library that brings Rust-inspired pattern matching and error handling to C++. It tries to imitate the functionality of the questionmark (?) operator in C++ by using a macro that uses the gcc extension https://gcc.gnu.org/onlinedocs/gcc/Statement-Exprs.html This allows to create exceptionless code with non-intrusive error-as-value that unlike Exceptions, makes it clear which kinds of error a function can generate and forces you to handle (or ignore) them. The ? operator translates to *expect* To handle the errors I…
2025 · github.com
- 21RM
2021 · hexdocs.pm
- 22RL
While working with LLMs for structured web data extraction, we saw issues with invalid JSON and broken links in the output. This led me to build a library focused on robust extraction and enrichment: - Clean HTML conversion: transforms HTML into LLM-friendly markdown with an option to extract just the main content - LLM structured output: Uses Gemini 2.5 flash or GPT-4o mini to balance accuracy and cost. Can also also use custom prompt - JSON sanitization: If the LLM structured output fails or doesn't fully match your schema, a sanitization process attempts to recover and fix the data,…
2025 · github.com
- 23TA
Hi community, we just released https://github.com/tonbo-io/typed-arrow. When working with arrow-rs, we noticed that schemas are declared at runtime. This often leads to runtime errors and makes development less safe. typed-arrow takes a different approach: - Schemas are declared at compile time with Rust’s type system. - This eliminates runtime schema errors. - And introduces no runtime overhead — everything is checked and generated by the compiler. If you’ve run into Arrow runtime schema issues, and your schema is stable (not defined or switched at runtime), this project…
2025 · github.com
- 24TP
2022 · github.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →