I am a horribly, horribly opinionated person who very rarely acts in a way that is not to further my own goals, wants and needs.
This project is not any different.
I would be open to working with the voidzero team on this project, though due to the fact that bun has been purchased by anthropic I would be unlikely to be open to working with the bun team on this. Nothing against the bun team, just a value I do not intend to comprimise right now.
Essentially, I agree with the movement that the voidzero team was making with vite+ and the general noise that they make is not something I find entirely disagreeable.
The issue is that ecosystems are by nature insecure and create many cascading points of failure that nobody ever fully accounts for. See the solarwinds Hack and the recent LiteLLM Hack
that is what I intend to fix with awplus, as well as a handful of other projects that I have been working on.
What is AWPlus?
awplus is a fork of vite+ that removes the yarn/pnpm/node setup they have an rather embraces the broader voidzero ecosystem and has a modified version of bun powering the runtime and package manager commands.
linking will be added to the modifed bun package manager over the next few weeks.
What is also planned in registry locking. You will be able to lock the project to a registry that I will maintain so that only a set of currated packages is ever availible for download, furthure reducing attack surface when using agents to update, develop or maintain these projects.
There are other developers helping with this, though if you would like to contribute please apply to join my Discord and we will evaluate what you have to offer.
Why though?
You see, we joke about the fact that JavaScript was created in a week, for a browser that no longer exists and with a standard that the browser did not use and does not share the namespace anyway (ECMAScript). But who actually does anything about it. JavaScript and JavaScript based ecosystems are hacked and hijacked on a near daily basis and we do nothing.