
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@likecoin/epub-ts
Advanced tools
@likecoin/epub-ts)A TypeScript fork of epubjs v0.3.93 by Fred Chasen / FuturePress — parse and render EPUB documents in the browser.
Note: This library is primarily developed for internal use at 3ook.com and is provided as-is. It was mainly built with AI-assisted development. For the original library, see epubjs.
.d.ts declarationsjszip); removed core-js, lodash, path-webpack, event-emitter, localforage, @xmldom/xmldomBook, EpubCFI, Rendition, etc.npm install @likecoin/epub-ts
import ePub from "@likecoin/epub-ts";
const book = ePub("/path/to/book.epub");
const rendition = book.renderTo("viewer", { width: 600, height: 400 });
rendition.display();
import ePub from "@likecoin/epub-ts";
const fileInput = document.querySelector('input[type="file"]');
fileInput.addEventListener("change", async (event) => {
const file = event.target.files[0];
const data = await file.arrayBuffer();
const book = ePub(data);
const rendition = book.renderTo("viewer", { width: 600, height: 400 });
rendition.display();
});
Parse EPUB metadata, spine, navigation, and section content without a browser. Requires linkedom as a peer dependency.
npm install linkedom
import { Book } from "@likecoin/epub-ts/node";
import { readFileSync } from "node:fs";
const data = readFileSync("book.epub");
const arrayBuffer = data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
const book = new Book(arrayBuffer);
await book.opened;
console.log(book.packaging.metadata.title);
console.log(book.navigation.toc.map(item => item.label));
const section = book.spine.first();
const html = await section.render(book.archive.request.bind(book.archive));
Drop-in replacement. Change your import:
- import ePub from "epubjs";
+ import ePub from "@likecoin/epub-ts";
All APIs remain the same.
import {
Book, EpubCFI, Rendition, Contents, Layout,
Section, Spine, Locations, Navigation, PageList,
Resources, Packaging, Archive, Store,
Annotations, Themes, Mapping,
} from "@likecoin/epub-ts";
See the full API documentation for details on all classes, interfaces, and methods.
Key classes:
| Class | Description |
|---|---|
Book | Main EPUB representation — loading, parsing, manipulation |
Rendition | Renders a book to a DOM element |
Contents | Manages content within an iframe |
EpubCFI | EPUB Canonical Fragment Identifier parser |
Locations | Generates and manages reading locations |
Navigation | Table of contents and landmarks |
Annotations | Highlights, underlines, and marks |
| Aspect | epub.ts | epubjs |
|---|---|---|
| Language | TypeScript (strict mode) | JavaScript |
| Build | Vite | webpack + Babel |
| Tests | Vitest | Karma + Mocha |
| Type definitions | Generated from source | Hand-written .d.ts |
| Dependencies | 1 (jszip) | 7+ (core-js, lodash, event-emitter, etc.) |
| API compatibility | 100% (drop-in replacement) | — |
| Bundle format | ESM + CJS + UMD | UMD |
| Maintenance | Active | Inactive since 2022 |
| Environment | Import | Notes |
|---|---|---|
| Modern browsers | @likecoin/epub-ts | Chrome, Firefox, Safari, Edge |
| Vite / webpack | @likecoin/epub-ts | ESM or CJS |
| Node.js 18+ | @likecoin/epub-ts/node | Parsing only (no rendering); requires linkedom peer dep |
core-js, lodash, path-webpack, localforage, @xmldom/xmldomevent-emitter with inline typed emitterlocalforage with native IndexedDB wrapper@xmldom/xmldom with native DOMParser/XMLSerializer@likecoin/epub-ts/node) with linkedomgit clone https://github.com/likecoin/epub.ts.git
cd epub.ts
npm install
| Script | Description |
|---|---|
npm run build | Vite library build → dist/ |
npm test | Run tests (Vitest) |
npm run test:watch | Run tests in watch mode |
npm run typecheck | TypeScript type checking (tsc --noEmit) |
npm run lint | ESLint |
npm run lint:fix | ESLint with auto-fix |
npm run docs | Generate API docs (HTML + Markdown) |
See PROJECT_STATUS.md for current conversion progress and what to work on.
For AI agents contributing to this project, see AGENTS.md.
BSD-2-Clause (same as epubjs)
This project is built and maintained by the 3ook.com team. 3ook is a Web3 eBook platform where authors can publish EPUB ebooks and readers can collect them as digital assets.
FAQs
TypeScript EPUB parser and renderer, forked from epubjs
The npm package @likecoin/epub-ts receives a total of 238 weekly downloads. As such, @likecoin/epub-ts popularity was classified as not popular.
We found that @likecoin/epub-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.