Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@afp/toolkit-decisive-moment
Advanced tools
This is a WIP / POC. This project aims at interfacing some functionalities of FFMPEG.wasm (only ffmpeg core available at time of writing) with a nice UI for the AFP journalists.
For now the only use-case is simple: a journalist needs to extract a few seconds -the "decisive moment"- from a (possibly quite long) video, to promote it on diverse (social) platforms. Hence it should also be cropped/resized to match the technical implications of those platforms.
It involves a step-by-step process, which should aim to be as modular as possible (hopefully, for future developement of similar tools).
This app is using the ffmpeg.wasm library in order to leverage the computing power on the client-side, instead of server-side. This aims to both unload DDV server(s), and avoid long upload/download durations. For now the video the user wants to edit is assumed to be their computer already.
Later-on we could imagine posting a request for each ffmpegOperation
to a server with a native FFMPEG installed (not using WebAssembly), if this becomes problematic (see SharedArrayBuffer
issue below, for example).
This is where the main logic is.
We created a custom reactive store store.js
with the Vue.observable()
function (instead of using Vuex). We could not use Vuex in the project because of the way it is integrated in Toolkit (which is an other Vue app). The store should be extended very carefully or rewritten to avoid mutability or anti-patterns.
It is responsible for:
Step
Operations Queue
" below.params
created inside the Steps
, make Operations
from them, and feed these to the Queue
.The ffmpeg WebAssembly code is initialized by the createFFmpeg()
function in the store.js
. It can take a few seconds to load (async, so doesn't block the main thread).
This is the file where we transform javascript objects into a string (see FFMPEGparamsList
) which is the command passed to FFMPEG.wasm. The function doFfmpegOperation
is not called directly, but instead passed as a callback to the ffmpegQueue (see Queue below).
See Queue.js
. This is a concurrent queue. It allows to execute the FFMPEG command lines asyncronously. By associating an id to every Operation
, we can freely add tasks to a queue/worker, and get their result back when they are finished.
This is the parent component. It is responsible for:
There are 3 types of Steps for now:
This is the step where the user manually imports the video(s) he wants to modify.
It's only one video for now, but we could imagine a multiple-imports possibility in the case we would want to combine videos. Also we only manage a few file formats for now.
To support other file formats we would need to convert them up-front, to be able to display them in the browser (this is problematic for long videos).
This is the last step. The user is able to:
These are the steps where the user actually modify/edit the video.
These should have as much feedback as possible on the immediate result(s) of the editing.
This is used by FFMPEG.wasm (like most WebAssembly code), and is subject to big changes/restrictions. As this project is hosted with other tools, this could become problematic if we cannot apply the new security rules (see https://web.dev/cross-origin-isolation-guide/).
If we are unable to use the FFMPEG.wasm library, the most realistic alternative seems to be using the same workflow as DDV (using FFMPEG on a server, instead of client-side). But this would imply huge video transfers (or new restrictions) and an even bigger load on AFP servers.
An other way would be to find an equivalent of FFMPEG.wasm that does not use SharedArrayBuffer
, but it seems unlikely at time of writing (mostly for performance reasons).
The current reactive store (using Vue.observable()
) is a compromise. Maybe a rewrite using a dedicated library would be necessary some time later.
Vuex could not be used because of Toolkit-related issues (integration) at time of writing. Simply put: currently Vuex must be on the App level, while this code is supposed to be imported in an other, bigger Vue App.
npm install
npm run serve
npm run build
npm run build && npm version patch && npm publish
npm run lint
npm run lint --fix
FAQs
prototyping ffmpeg wasm tool
The npm package @afp/toolkit-decisive-moment receives a total of 41 weekly downloads. As such, @afp/toolkit-decisive-moment popularity was classified as not popular.
We found that @afp/toolkit-decisive-moment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.