quickjs-rs

What it is and what it does

quickjs-rs runs JavaScript inside a WebAssembly sandbox, isolating guest code from the Python host. The package bundles quickjs-ng (a QuickJS fork) compiled to WebAssembly and driven by wasmtime; it ships as a pure-Python wheel with no native compilation step. You write Python code that creates a Runtime and Context, then eval JavaScript strings or async code, optionally registering Python callables as JS globals and vice versa.

The sandbox supports ES modules with custom host-controlled resolution, TypeScript source stripping before evaluation, and full async/await semantics bridging Python and JS. You can also capture and restore entire VM snapshots—heap state, closures, pending promises—as binary payloads. The security model relies on WebAssembly's linear-memory isolation; the JS engine cannot access Python's address space, though wasmtime itself remains the residual attack surface.

Use it for:

• Execute untrusted or user-supplied JavaScript safely without exposing the Python process to direct memory access.
• Bridge Python and JavaScript logic in a single process—call Python functions from JS and vice versa with type conversion.
• Load and run ES modules with custom resolution policy, enabling plugin architectures or dynamic code loading.
• Strip and execute TypeScript source code without a separate compilation step or type-checking pipeline.
• Snapshot a fully initialized JS VM state and restore it into fresh contexts for fast, stateful re-execution.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Executes JavaScript code inside a WebAssembly sandbox from Python, with support for ES modules, TypeScript stripping, async/await, and Python-to-JS function bridging.

Yes, if you need sandboxed JavaScript execution in Python and can tolerate the experimental status. The low install friction, active maintenance, permissive license, and zero known vulnerabilities make it a reasonable choice. Read the security guide before production use—wasmtime updates are critical, and snapshot bytes are treated as trusted input. Not suitable if you need a mature, battle-tested JS runtime or if your Python version is below 3.11.

Install

quickjs-rs on PyPI

pip install quickjs-rs

uv add quickjs-rs

poetry add quickjs-rs

Installing quickjs-rs

Before you install

Low friction: ships as a single universal wheel with no compiled dependencies beyond wasmtime. Active maintenance (last commit 2026-07-24, released 21 days ago). Requires Python 3.11+; runs on Linux, macOS, Windows (x86_64 + arm64).

License in practice

MIT license (permissive) — you may use, modify, and distribute freely with minimal restrictions, provided you retain the license notice.

Quickstart

pip install quickjs-rs

from quickjs_rs import Runtime

with Runtime() as rt:
    with rt.new_context() as ctx:
        result = ctx.eval("1 + 2")
        print(result)  # 3

Requires Python 3.11+. wasmtime must be available as a runtime dependency (installed automatically).

Verify before relying

• Performance characteristics and overhead compared to native JS runtimes or other Python JS bindings
• Completeness of ES module resolution and TypeScript support relative to production use cases
• Snapshot serialization format stability and forward/backward compatibility guarantees

Package facts

Evidence: quickjs_rs-0.2.5-py3-none-any.whl

Keywords: javascript, quickjs, sandbox, wasm, wasmtime

Tags

More Interpreters packages