
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@derogab/stt-proxy
Advanced tools
A simple and lightweight proxy for seamless integration with multiple STT (Speech-to-Text) providers including Whisper.cpp
A simple and lightweight proxy for seamless integration with multiple STT providers including Whisper.cpp and Cloudflare AI.
npm install @derogab/stt-proxy
import { transcribe } from '@derogab/stt-proxy';
const result = await transcribe('/path/to/audio.wav');
console.log(result.text);
The package automatically detects which STT provider to use based on your environment variables. Configure one or more providers:
STT_PROVIDER=cloudflare # Optional, force a specific provider (whisper.cpp, cloudflare)
When STT_PROVIDER is set, the specified provider will be used and an error is thrown if its credentials are not configured. When not set, providers are selected automatically based on priority.
Note:
PROVIDERis supported as a fallback for backward compatibility whenSTT_PROVIDERis not set.
WHISPER_CPP_MODEL_PATH=/path/to/ggml-base.bin # Required, path to your GGML model file
Download models from HuggingFace:
curl -L -o ggml-base.bin https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-base.bin
CLOUDFLARE_ACCOUNT_ID=your-account-id # Required
CLOUDFLARE_AUTH_KEY=your-api-token # Required
Uses the @cf/openai/whisper-large-v3-turbo model.
transcribe(audio: string | Buffer, options?): Promise<TranscribeOutput>Transcribes audio to text using the configured STT provider. The package automatically manages provider initialization and cleanup.
Parameters:
audio: Path to audio file (string) or audio Bufferoptions (optional): Transcription optionsReturns:
text propertyOptions Format:
type TranscribeOptions = {
language?: string; // Language code (e.g., 'en', 'es', 'fr')
translate?: boolean; // Translate to English
};
Output Format:
type TranscribeOutput = {
text: string;
};
Example:
// Transcribe from file path
const result1 = await transcribe('/path/to/audio.wav');
console.log(result1.text);
// Transcribe from Buffer
const audioBuffer = fs.readFileSync('/path/to/audio.wav');
const result2 = await transcribe(audioBuffer);
console.log(result2.text);
// With options
const result3 = await transcribe('/path/to/audio.wav', {
language: 'en',
translate: false
});
console.log(result3.text);
When STT_PROVIDER environment variable is set, that provider is used directly.
Otherwise, the package selects providers in the following order:
WHISPER_CPP_MODEL_PATH is set and file exists)CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_AUTH_KEY are set)If no providers are configured, the function throws an error.
# macOS
brew install ffmpeg
# Ubuntu/Debian
sudo apt install ffmpeg
# Windows (with Chocolatey)
choco install ffmpeg
# Install dependencies
npm install
# Build the package
npm run build
# Run tests
npm test
STT Proxy is made with ♥ by derogab and it's released under the MIT license.
If you like this project or directly benefit from it, please consider buying me a coffee:
🔗 bc1qd0qatgz8h62uvnr74utwncc6j5ckfz2v2g4lef
⚡️ derogab@sats.mobi
💶 Sponsor on GitHub
FAQs
A simple and lightweight proxy for seamless integration with multiple STT (Speech-to-Text) providers including Whisper.cpp
We found that @derogab/stt-proxy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.