FAQ

Why deny-by-default instead of an allowlist like Bun’s trustedDependencies?

An allowlist still has to be right for every entry, forever, and a non-registry specifier (file:/git:/github:) sharing a trusted package’s name can slip past it — this is exactly what CVE-2026-24910 exploited in Bun. 3va has no allowlist for install scripts to begin with: they never run by default, full stop, with a single explicit 3VA_ALLOW_SCRIPTS=1 escape hatch you opt into per-invocation rather than per-package. See Package Manager and the Comparison table.

Does 3va audit run automatically when I install a package?

Partially. A malware scan runs automatically on every downloaded tarball during 3va install and can abort the install on a high-severity finding. The full 3va audit command — the OSV/CVE scan and, with --secrets, credential scanning — is manual. Run 3va audit --secrets yourself after adding dependencies. See Roadmap.

Can a dependency’s permission grant leak to another dependency?

No. package.json "3va" permission scopes are enforced per-package by a thread-local execution scope, not just documented convention — a grant under "express" only applies while express’s own code is on the call stack. See Permissions § Scopes are enforced for the one known bypass (constructors like net.Socket aren’t wrapped).

Why is 3va’s HTTP throughput lower than Bun’s in the comparison table?

3va’s connection limiter deliberately sheds excess connections instead of queuing them, and firewall checks run in the accept loop before any request reaches JavaScript — that’s overhead Bun doesn’t pay. The published benchmark number itself was measured with firewall limits raised; at the shipped defaults (100 req/s, 50 connections/IP) a single-machine load test mostly gets 403, which is the firewall working as intended. See HTTP Performance.

Is Android supported?

Not currently on main — Android arm64 builds broke in v2.2.0 when the runtime migrated from QuickJS to V8 (no official Android binaries for the V8 binding). Use the android-pre-v8 branch as a workaround. Linux arm64 is unaffected — that cross-build issue was separate and has been fixed. See Roadmap § Platform support.

Does 3va terminate TLS for HTTPS servers?

No. https.createServer() does not terminate TLS at all — put a reverse proxy in front for TLS termination. Post-quantum TLS (tls.pqConnect()) is a client-only feature for outbound connections; see Roadmap § Post-quantum TLS.

Can I use my existing Jest test suite?

If it uses describe/test/expect with the common assertion matchers and snapshots, likely yes. If it relies on jest.fn()/mocks or matchers like toMatchObject/toHaveBeenCalledWith, not yet — see the matcher list in Dev Tooling § Test runner.

How do I point 3va at a package.json script instead of a built-in subcommand?

You don’t have to do anything special: 3va <name> runs package.json.scripts.<name> automatically whenever <name> isn’t one of 3va’s own subcommands. This delegates to a real external process (your actual package manager) and is explicitly outside the permission system — see Dev Tooling § package.json scripts fallback.

Where do these numbers come from?

The Comparison table is generated by CI (.github/workflows/benchmark.yml + bench/run.sh) on every relevant change, not hand-edited. Reproduce it yourself with bash bench/run.sh in the 3va repository .