
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
A Go command-line tool and library for flashing firmware to Espressif ESP8266 and ESP32-family microcontrollers over serial (UART) or USB-JTAG/Serial connections.
You can download and install one of the prebuilt binaries for your operating system under "Releases" or install from source:
go install tinygo.org/x/espflasher@latest
# Install
go install tinygo.org/x/espflasher@latest
# Flash a single binary
espflasher -port /dev/ttyUSB0 firmware.bin
# Flash with specific offset and chip
espflasher -port /dev/ttyUSB0 -offset 0x10000 -chip esp32s3 app.bin
# Flash via native USB-JTAG/Serial (ESP32-S3, ESP32-C3, etc.)
espflasher -port /dev/ttyACM0 -reset usb-jtag -chip esp32s3 firmware.bin
# Flash multiple images (bootloader + partitions + app)
espflasher -port /dev/ttyUSB0 \
-bootloader bootloader.bin \
-partitions partitions.bin \
-app application.bin
# Erase flash before writing
espflasher -port /dev/ttyUSB0 -erase-all firmware.bin
go get tinygo.org/x/espflasher/pkg/espflasher
package main
import (
"fmt"
"log"
"os"
"tinygo.org/x/espflasher/pkg/espflasher"
)
func main() {
// Connect to the ESP device
flasher, err := espflasher.New("/dev/ttyUSB0", nil)
if err != nil {
log.Fatal(err)
}
defer flasher.Close()
fmt.Printf("Connected to %s\n", flasher.ChipName())
// Read the firmware binary
data, err := os.ReadFile("firmware.bin")
if err != nil {
log.Fatal(err)
}
// Flash with progress reporting
err = flasher.FlashImage(data, 0x0, func(current, total int) {
fmt.Printf("\rFlashing: %d/%d bytes (%.0f%%)", current, total,
float64(current)/float64(total)*100)
})
if err != nil {
log.Fatal(err)
}
fmt.Println()
// Reset the device to run the new firmware
flasher.Reset()
fmt.Println("Done!")
}
/dev/ttyACM0 on Linux, cu.usbmodem* on macOS)The nvs package provides a pure-Go implementation for generating and parsing ESP-IDF NVS (Non-Volatile Storage) partition images in the v2 binary format.
go get tinygo.org/x/espflasher/pkg/nvs
import "tinygo.org/x/espflasher/pkg/nvs"
entries := []nvs.Entry{
{Namespace: "wifi", Key: "ssid", Type: "string", Value: "MyNetwork"},
{Namespace: "wifi", Key: "channel", Type: "u8", Value: uint8(6)},
{Namespace: "config", Key: "timeout", Type: "u16", Value: uint16(3000)},
{Namespace: "config", Key: "name", Type: "string", Value: "MyDevice"},
}
partition, err := nvs.GenerateNVS(entries, nvs.DefaultPartSize)
if err != nil {
log.Fatal(err)
}
// partition is a []byte ready to flash at the NVS partition offset
entries, err := nvs.ParseNVS(partitionData)
if err != nil {
log.Fatal(err)
}
for _, e := range entries {
fmt.Printf("[%s] %s = %v\n", e.Namespace, e.Key, e.Value)
}
| Type | Go Value Type |
|---|---|
u8 | uint8 (or int) |
u16 | uint16 (or int) |
u32 | uint32 (or int) |
i8 | int8 (or int) |
i16 | int16 (or int) |
i32 | int32 (or int) |
string | string |
blob | []byte |
| CLI Flag | Go Constant | Description |
|---|---|---|
default | ResetDefault | Classic DTR/RTS reset sequence. Works with most boards using a USB-to-UART bridge (CP2102, CH340, etc.). |
usb-jtag | ResetUSBJTAG | Reset sequence for boards with a native USB-JTAG/Serial interface (ESP32-S3, ESP32-C3, ESP32-C6, ESP32-H2). Use this when connected via /dev/ttyACM0 (Linux) or cu.usbmodem* (macOS). |
no-reset | ResetNoReset | Skip hardware reset entirely. Useful when the chip is already in bootloader mode or reset is handled externally. |
// With default options (115200 baud, auto-detect, compressed)
flasher, err := espflasher.New("/dev/ttyUSB0", nil)
// With custom options
opts := espflasher.DefaultOptions()
opts.FlashBaudRate = 921600
opts.ChipType = espflasher.ChipESP32S3
opts.Logger = &espflasher.StdoutLogger{W: os.Stdout}
flasher, err := espflasher.New("/dev/ttyUSB0", opts)
// For boards with native USB-JTAG/Serial (ESP32-S3, ESP32-C3, etc.)
opts.ResetMode = espflasher.ResetUSBJTAG
flasher, err := espflasher.New("/dev/ttyACM0", opts)
data, _ := os.ReadFile("firmware.bin")
err := flasher.FlashImage(data, 0x0, progressCallback)
images := []espflasher.ImagePart{
{Data: bootloaderBin, Offset: 0x1000},
{Data: partitionsBin, Offset: 0x8000},
{Data: applicationBin, Offset: 0x10000},
}
err := flasher.FlashImages(images, progressCallback)
// Erase entire flash
err := flasher.EraseFlash()
// Erase a specific region (must be sector-aligned)
err := flasher.EraseRegion(0x10000, 0x100000)
// Read a hardware register
val, err := flasher.ReadRegister(0x3FF00050)
// Hard reset the device
flasher.Reset()
The library is organized in layers:
| Layer | File(s) | Description |
|---|---|---|
| SLIP | pkg/espflasher/slip.go | Serial Line Internet Protocol framing |
| Protocol | pkg/espflasher/protocol.go | ROM bootloader command/response protocol |
| Chip | pkg/espflasher/chip.go, pkg/espflasher/target_*.go | Per-target definitions and detection |
| Reset | pkg/espflasher/reset.go | Hardware reset strategies |
| Flasher | pkg/espflasher/flasher.go | High-level flash/verify/reset API |
| NVS | pkg/nvs/*.go | Generate and parse NVS partition images |
| CLI | main.go | Command-line interface |
The flasher includes pre-compiled bootloader stubs from esp-flasher-stub releases. To update stubs:
stubVersion in tools/update-stubs.go to the desired release versiongo generate ./pkg/espflasher/... to download and embed the latest stubsgo:generate directive in pkg/espflasher/stub.go will invoke tools/update-stubs.goThis library implements the ESP serial bootloader protocol as documented by Espressif's esptool. Key protocol features:
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.