
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@borewit/text-codec
Advanced tools
@borewit/text-codecA lightweight alternative implementation of TextEncoder / TextDecoder supporting common encodings missing in some JavaScript engines and Node.js builds.
Works in environments like Hermes (React Native) or Small-ICU Node.js where only UTF-8 and UTF-16LE are available.
| Encoding | Hermes — Encode | Hermes — Decode | Small-ICU Node.js — Encode | Small-ICU Node.js — Decode |
|---|---|---|---|---|
utf-8 / utf8 | ➕ | Native | Native | Native |
| utf-16le | ➕ | ➕ | Native | Native |
| ascii | ➕ | ➕ | ➕ | ➕ |
latin1 / iso-8859-1 | ➕ | ➕ | ➕ | Native (sometimes) |
| windows-1252 | ➕ | ➕ | ➕ | ➕ |
Legend:
When your project needs to handle encodings like latin1 / iso-8859-1 or windows-1252 in these environments,
native TextDecoder / TextEncoder may throw an error or return incorrect results.
utf-8 / utf8utf-16leasciilatin1 / iso-8859-1windows-1252npm install @borewit/text-codec
textDecode(bytes, encoding): stringDecodes binary data into a JavaScript string using the specified encoding.
Parameters
bytes (Uint8Array) — The binary data to decode.encoding (SupportedEncoding, optional) — Encoding type. Defaults to "utf-8".Returns
string — The decoded text.Example
import { textDecode } from "@borewit/text-encode";
const bytes = new Uint8Array([0x48, 0x65, 0x6c, 0x6c, 0x6f]);
const text = textDecode(bytes, "ascii");
console.log(text); // "Hello"
Encodes a JavaScript string into binary form using the specified encoding.
textEncode(input, encoding): Uint8ArrayParameters
input (string) — The string to encode.encoding (SupportedEncoding, optional) — Encoding type. Defaults to "utf-8".Returns
Uint8Array — The encoded binary data.
Example:
import { textEncode } from "@borewit/text-encode";
const bytes = textEncode("Hello", "utf-16le");
console.log(bytes); // Uint8Array([...])
This project is licensed under the MIT License. Feel free to use, modify, and distribute as needed.
FAQs
Text Decoder
The npm package @borewit/text-codec receives a total of 9,261,427 weekly downloads. As such, @borewit/text-codec popularity was classified as popular.
We found that @borewit/text-codec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.