I built a JS/TS runtime in Rust where nothing runs without your permission (opens in new tab)

Last week I shipped v2.0.2 of 3va — a JavaScript and TypeScript runtime written in Rust. Here is why I built it and what makes it different from Node.js, Bun, and Deno. The problem In 2024, the xz backdoor was hidden inside a postinstall script. The event-stream attack in 2018 targeted a specific Bitcoin wallet by injecting code at install time. The node-ipc protest-ware in 2022 deleted files on machines with Russian or Belarusian IP addresses. All three attacks had the same root cause: the r...