Versions:
3va is a secure-by-default JavaScript and TypeScript runtime developed by OdinoCano, positioned within the development tools and runtime environments category. Built on the V8 engine, it executes both JavaScript and TypeScript code while emphasizing security as its central design principle. The runtime implements capability-based sandboxing, meaning that every permission — including filesystem access, network connectivity, environment variable reading, and subprocess execution — is denied by default and must be explicitly granted on a per-script basis. This model reduces the attack surface of untrusted or third-party code, making 3va suitable for running scripts in environments where supply-chain security and least-privilege execution are priorities. As an additional protective measure, post-install scripts are blocked unconditionally, preventing packages from executing arbitrary code during installation. The runtime also incorporates post-quantum cryptography, supporting the ML-KEM and ML-DSA algorithms, which makes it relevant for use cases that require resistance to future quantum computing threats. WebAssembly support is included, allowing developers to run Wasm modules alongside JavaScript and TypeScript workloads. Another distinguishing feature is the built-in process supervisor, which eliminates the need for external process management tools such as pm2 when deploying long-running services or applications. The current version of 3va is 2.8.0, and the software has been distributed across twelve versions, indicating an active release history with ongoing development. Typical use cases include executing server-side scripts, hosting applications with controlled permissions, deploying services with integrated supervision, and experimenting with post-quantum cryptographic primitives in a modern runtime. By combining a permission-denied-by-default security model, modern cryptography, WebAssembly compatibility, and operational tooling in a single package, 3va serves developers seeking a hardened alternative to conventional JavaScript runtimes.
Tags: