Observed Signal · Jun 15, 2026 · Technical Release · Source: DEV Community · Impact: 2/5 · Sentiment: Neutral
3va: Rust JS/TS Runtime Enforces Runtime Permissions
The author released v2.0.0 of 3va, a JavaScript and TypeScript runtime implemented in Rust that enforces explicit, runtime-level permissions. 3va defaults all capabilities (filesystem, network, env vars, child processes, native addons) to blocked and requires an explicit permission declaration in package.json; post-install scripts are never executed. It is designed as a drop-in replacement for existing registries and frameworks (frontend and backend frameworks listed) and includes an integrated package manager, built-in process manager (auto-restart, persistent state), test runner, bundler, dev server, profiler, malware/audit tooling, and DDoS protections (hard connection limit 1,024 + Slowloris mitigation). The runtime exposes post-quantum crypto primitives (ML-KEM-768, ML-DSA-65) and a hybrid TLS API (__pqTlsConnect). The author notes honest benchmarks where 3va trades raw throughput/startup for stronger permission isolation.
Developer tooling release that addresses supply-chain and runtime permission security; relevant to engineering teams but not an industry-shifting platform announcement.
Track ARD Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- 3va v2.0.0 was released as a JavaScript/TypeScript runtime written in Rust.
- 3va enforces a default-deny permissions model: filesystem, network, environment variables, child processes and native addons are blocked unless explicitly granted.
- Post-install scripts are blocked unconditionally at runtime; package managers do not execute them when using 3va.
- 3va includes an integrated package manager, a built-in process manager with auto-restart and persistent process state, and DDoS protections (1,024 hard connection limit and Slowloris mitigation).
- The runtime exposes post-quantum crypto (ML-KEM-768, ML-DSA-65) to JavaScript and provides a hybrid TLS API (__pqTlsConnect).
Connected Companies & Entities
3 Entities mappedOntology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
3va: Rust-built JS/TS runtime with strict permissions
3va v2.0.2 is a JavaScript and TypeScript runtime implemented in Rust that enforces capability-based permissions by default. The runtime blocks filesystem, network, environment, child processes, and native addon access unless explicitly allowed, and it unconditionally prevents post-install scripts from running. 3va installs from standard registries (npm, Yarn, etc.), aims to be compatible with common frameworks (Next.js, React, Express, Fastify and others), and bundles a package manager, built-in process manager, test runner, bundler, DDoS protections, and post-quantum cryptography primitives. The author publishes benchmarks comparing 3va (debug build) with Node.js and Bun—acknowledging Bun’s superior raw throughput and startup—but emphasizes 3va’s security and permission isolation as its primary value. Multiple install channels are provided (npm, Homebrew, Chocolatey, Scoop, cargo, Flatpak).
Secure Code Execution Sandbox Built in Rust
A developer describes Custody, a Rust-based secure code execution sandbox built as a layered defense against attacks such as fork bombs, memory exhaustion, network exfiltration, syscall abuse, and infinite loops. The design stacks gVisor (runsc with --network=none and --no-new-privs) as an outer syscall interposer, cgroups v2 for CPU, memory, PID and wall-time limits, and seccomp syscall allowlists as the innermost kernel-level filter. Additional protections include output caps, OOM detection via cgroup memory.current, and a labeled kill-reason taxonomy (timeout_wall, output_limit, oom, seccomp_violation, clean) to improve auditability. The author reports 100% containment across eight tested attack scenarios and lists planned v2 improvements: prebuilt OCI rootfs images, pidfd_open+epoll for instant process exit detection, and automated seccomp generation using eBPF or strace.
revera 1.0.0 Released: npm Package Security CLI
Aarav Maloo announced the release of revera@1.0.0, an open-source CLI that scores npm packages for security risk prior to installation. The 1.0.0 rewrite replaces fixed weights with a Bayesian evidence engine: each package is modeled as a node in its dependency graph, scored across eight categories using signals such as vulnerability feeds, publisher trust, GitHub activity, and typosquat detection, with risk propagated bottom-up through the entire dependency tree. The post was published on 2026-07-18 and includes the install command 'npm install revera'.
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.