
Research
Security News
Malicious npm Packages Target BSC and Ethereum to Drain Crypto Wallets
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
@empiricalrun/llm
Advanced tools
Package to connect and trace LLM calls.
import { LLM } from "@empiricalrun/llm";
const llm = new LLM({
provider: "openai",
defaultModel: "gpt-4o",
});
const llmResponse = await llm.createChatCompletion({ ... });
This package also contains utilities for vision, e.g. extract text (OCR).
import { extractText } from "@empiricalrun/llm/vision";
// With Appium
const data = await driver.saveScreenshot('dummy.png');
const instruction = "Extract number of ATOM tokens from the image. Return only the number.";
const text = await extractText(data.toString('base64'), instruction);
// Example response: "0.01"
import { getBoundingBox } from "@empiricalrun/llm/vision";
// With Appium
const data = await driver.saveScreenshot('dummy.png');
// Give a line describing the screen and then the element that you want to find
const instruction = "This screenshot shows a screen to send crypto tokens. What is the bounding box for the dropdown to select the token?";
const bbox = await getBoundingBox(data.toString('base64'), instruction);
const centerToTap = bbox.center; // { x: 342, y: 450 }
// **Note**: These coordinates are relative to the image dimensions, and actions like
// tap require scaling the coordinates to Appium coordinates
Bounding box can require some prompt iterations, and you can do that with a debug
flag. This flag
copies the output of the operation to your clipboard (macOS only.)
Paste this output in the address bar of your browser to visualize the output.
const bbox = await getBoundingBox(data.toString('base64'), instruction, { debug: true });
Example script for prompt iterations. The package should be installed and available to this script.
// Create script.mjs
// Run as `node script.mjs`
import fs from "fs";
import { getBoundingBox } from "@empiricalrun/llm/vision";
async function main() {
const prompt = "What is the bounding box for the first dropdown menu?";
const imagePath = "/path/to/the/image.png";
const imageData = fs.readFileSync(imagePath).toString("base64");
await getBoundingBox(imageData, prompt, { debug: true });
// The debug output has been copied -- paste it in the web browser
}
main();
FAQs
Package to connect and trace LLM calls.
The npm package @empiricalrun/llm receives a total of 752 weekly downloads. As such, @empiricalrun/llm popularity was classified as not popular.
We found that @empiricalrun/llm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovered four malicious npm packages that exfiltrate up to 85% of a victim’s Ethereum or BSC wallet using obfuscated JavaScript.
Security News
TC39 advances 9 JavaScript proposals, including Array.fromAsync, Error.isError, and Explicit Resource Management, which are now headed into the ECMAScript spec.
Security News
Vite releases Rolldown-Vite, a Rust-based bundler preview offering faster builds and lower memory usage as a drop-in replacement for Vite.