
Research
GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.
@diffusion-studio/ffmpeg-js
Advanced tools
FFmpeg.js - Use FFmpeg in the browser powered by WebAssembly
Welcome to FFmpeg.js, an innovative library that offers a WebAssembly-powered interface for utilizing FFmpeg in the browser. ππ‘

This project has been inspired by the awesome work of ffmpeg.wasm, but we noted a few drawbacks that might limit its applicability for broader use:
Addressing the issues above, FFmpeg.js:
fluent-ffmpeg
, making it more programmer-friendly. π―πHowever, it's important to note that as of now, FFmpeg.js runs only in Chrome, Firefox, and Edge browsers. It doesn't support Safari or Node. π§π
Setting up FFmpeg.js is a breeze!
npm i @diffusion-studio/ffmpeg-js
This should install the library. Now because ffmpeg.js requires the use of the SharedArrayBuffer you need to enable Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp on the server side.
In a vite environment you can simply add these policies by putting the following into your vite.config.js:
...
server: {
...
headers: {
'Cross-Origin-Embedder-Policy': 'require-corp',
'Cross-Origin-Opener-Policy': 'same-origin',
},
},
...
Here is an example next.config.js that supports the SharedArrayBuffer:
module.exports = {
async headers() {
return [
{
source: '/',
headers: [
{
key: 'Cross-Origin-Embedder-Policy',
value: 'require-corp',
},
{
key: 'Cross-Origin-Opener-Policy',
value: 'same-origin',
},
],
},
];
},
};
Somewhere in your project you need to initiate a ffmpeg instance.
import { FFmpeg } from '@diffusion-studio/ffmpeg-js';
const ffmpeg = new FFmpeg();
By default this will pull a LGPLv2.1 compliant build of FFmpeg from the UNPKG delivery network.
Consequently if you immidiately intent to run commands you need to wait until the binaries have been fetched successfully, like this:
ffmpeg.whenReady(async () => {
await ffmpeg.exec(['-help']);
});
This will output the ffmpeg help as fast as possible.
HINT: Even though this library intends to provide a object oriented interface for ffmpeg, you can still run commands manually using the
execmethod.
When working with files you need to save them to the in-memory file system first:
const source = 'https://<path to file>/<filename>.mp4';
// write to file system
await ffmpeg.writeFile('input.mp4', source);
// convert mp4 to avi
await ffmpeg.exec(['-i', 'input.mp4', 'output.avi']);
// read from file system
const result: Uint8Array = ffmpeg.readFile('output.avi');
// free memory
ffmpeg.deleteFile('input.mp4');
ffmpeg.deleteFile('output.avi');
Let's see how you would get the same result the object oriented way.
const source = 'https://<path to file>/<filename>.mp4';
const result: Uint8Array = ffmpeg
.input({ source })
.ouput({ format: 'avi' })
.export();
If you were wondering, yes the memory is being managed for you.
Take a look at these tests for more examples:
Currently there are two different FFmpeg configurations available with more on the way.
lgpl-base (default): It is a compilation of FFmpeg without any external libraries, which is useful for audio & video muxing/demuxing and audio encoding/decoding. It is v2.1LGPL compliant and can therefore be used for commercial projects.gpl-extended: This is the @ffmpeg/core configuration, that has been built with --enable-gpl and --enable-nonfree and can therefore only be used for commercial projects if the entire codebase is publicly accessible. It supports popular delivery codecs such as h264/h265/vp9 etc.For more information about the supported codecs and muxers run the following commands:
console.log(await ffmpeg.codecs());
console.log(await ffmpeg.formats());
This is how you can switch the configuration:
import {
FFmpeg,
FFmpegConfigurationGPLExtended,
} from '@diffusion-studio/ffmpeg-js';
// FFmpegConfigurationGPLExtended will add the type extensions
const ffmpeg = new FFmpeg<FFmpegConfigurationGPLExtended>({
config: 'gpl-extended',
});
Thats it!
We believe that FFmpeg.js will significantly streamline your interaction with FFmpeg in the browser, providing a more effective and efficient coding experience. Happy coding! ππ
The information contained in this text is provided for informational purposes only. It is not intended as a comprehensive guide to the GPL and LGPL license usages nor does it offer legal advice. Laws and regulations surrounding software licenses can be complex and may change over time. The author and provider of this information cannot be held responsible for any errors, omissions, or any outcomes related to your use of this information.
While every effort has been made to ensure the information presented here is accurate as of the date of publication, no guarantee is given as to its currency or applicability to your specific situation. You should not rely upon this information as a substitute for consultation with a legal professional or other competent advisors. Always consult with a qualified professional familiar with your particular circumstances before making decisions that could have legal implications.
FAQs
FFmpeg.js - Use FFmpeg in the browser powered by WebAssembly
The npm package @diffusion-studio/ffmpeg-js receives a total of 4,219 weekly downloads. As such, @diffusion-studio/ffmpeg-js popularity was classified as popular.
We found that @diffusion-studio/ffmpeg-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.

Company News
Socket was named to the Rising in Cyber 2026 list, recognizing 30 private cybersecurity startups selected by CISOs and security executives.

Research
Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware.