Repository navigation
FAQ
An allowlist still has to be right for every entry, forever, and a non-registry specifier (file:/git:/github:) sharing a trusted package's name can slip past it — this is exactly what CVE-2026-24910 exploited in Bun. 3va has no allowlist for install scripts to begin with: they never run by default, full stop, with a single explicit 3VA_ALLOW_SCRIPTS=1 escape hatch you opt into per-invocation rather than per-package. See Package Manager and Comparison.
Partially. A malware scan runs automatically on every downloaded tarball during 3va install and can abort the install on a high-severity finding. The full 3va audit command — the OSV/CVE scan and, with --secrets, credential scanning — is manual. Run 3va audit --secrets yourself after adding dependencies. See Roadmap.
No. package.json "3va" permission scopes are enforced per-package by a thread-local execution scope, not just documented convention — a grant under "express" only applies while express's own code is on the call stack. See Permissions for the one known bypass (constructors like net.Socket aren't wrapped).
3va's connection limiter deliberately sheds excess connections instead of queuing them, and firewall checks run in the accept loop before any request reaches JavaScript — that's overhead Bun doesn't pay. The published benchmark number itself was measured with firewall limits raised; at the shipped defaults (100 req/s, 50 connections/IP) a single-machine load test mostly gets 403, which is the firewall working as intended. See HTTP Performance.
Not currently on main — Android arm64 builds broke in v2.2.0 when the runtime migrated from QuickJS to V8 (no official Android binaries for the V8 binding). Use the android-pre-v8 branch as a workaround. Linux arm64 is unaffected — that cross-build issue was separate and has been fixed. See Roadmap.
Yes, since 2.12. https.createServer({ key, cert }) is a real TLS listener (TLS 1.2 and 1.3 with the runtime's crypto provider, the FIPS module in a fips build) and offers the hybrid post-quantum key exchange X25519MLKEM768 to clients that support it. Every firewall limit applies as for plain HTTP. key and cert must be PEM; pfx, passphrase, requestCert, ca, SNICallback and crl throw instead of being ignored. Before 2.12 it served cleartext and ignored the key and certificate. A reverse proxy is still a sensible choice for certificate rotation and SNI. tls.pqConnect() is the separate client-side API for outbound connections; see Roadmap.
If it uses describe/test/expect with the common assertion matchers and snapshots, likely yes. If it relies on jest.fn()/mocks or matchers like toMatchObject/toHaveBeenCalledWith, not yet — see the matcher list in Dev Tooling.
You don't have to do anything special: 3va <name> runs package.json.scripts.<name> automatically whenever <name> isn't one of 3va's own subcommands. This delegates to a real external process (your actual package manager) and is explicitly outside the permission system — see Dev Tooling.
The Comparison table is generated by CI (.github/workflows/benchmark.yml + bench/run.sh) on every relevant change, not hand-edited. Reproduce it yourself with bash bench/run.sh in the 3va repository.