Last week I shipped v2.0.0 of 3va — a JavaScript and TypeScript runtime written in Rust. Here is why I built it and what makes it different from Node.js, Bun, and Deno.
The problem
In 2024, the xz backdoor was hidden inside a postinstall script. The event-stream attack in 2018 targeted a specific Bitcoin wallet by injecting code at install time. The node-ipc protest-ware in 2022 deleted files on machines with Russian or Belarusian IP addresses.
All three attacks had the same root cause: the runtime trusted the package.
npm, pnpm, Yarn, and Bun all execute postinstall scripts by default. Some let you opt out. None of them block it unconditionally at the runtime level — because that would require the runtime to enforce permissions, and none of them do.
