
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mathquis/node-gist
Advanced tools

Gist is a C++ based audio analysis library
Gist is written and maintained by Adam Stark.
Firstly, import the Gist header file:
#include "Gist.h"
Gist is a template class, so instantiate it with floating point precision:
int frameSize = 512;
int sampleRate = 44100;
Gist<float> gist (frameSize, sampleRate);
Or with double precision:
Gist<double> gist (frameSize, sampleRate);
We proceed with the documentation as if we were using floating point precision.
Once you have an audio frame, pass it to the Gist object. You can do this either as a STL vector:
std::vector<float> audioFrame;
// !
// fill audio frame with samples here
// !
gist.processAudioFrame (audioFrame);
Or, as an array:
float audioFrame[512];
// !
// fill audio frame with samples here
// !
gist.processAudioFrame (audioFrame, 512);
Now we can retrieve some audio features.
// Root Mean Square (RMS)
float rms = gist.rootMeanSquare();
// Peak Energy
float peakEnergy = gist.peakEnergy();
// Zero Crossing rate
float zcr = gist.zeroCrossingRate();
// Spectral Centroid
float specCent = gist.spectralCentroid();
// Spectral Crest
float specCrest = gist.spectralCrest();
// Spectral Flatness
float specFlat = gist.spectralFlatness();
// Spectral Rolloff
float specRolloff = gist.spectralRolloff();
// Spectral Kurtosis
float specKurtosis = gist.spectralKurtosis();
// Energy difference
float ed = gist.energyDifference();
// Spectral difference
float sd = gist.spectralDifference();
// Spectral difference (half-wave rectified)
float sd_hwr = gist.spectralDifferenceHWR();
// Complex Spectral Difference
float csd = gist.complexSpectralDifference();
// High Frequency Content
float hfc = gist.highFrequencyContent();
// FFT Magnitude Spectrum
const std::vector<float>& magSpec = gist.getMagnitudeSpectrum();
// Pitch Estimation
float pitch = gist.pitch();
// Mel-frequency Spectrum
const std::vector<float>& melSpec = gist.getMelFrequencySpectrum();
// MFCCs
const std::vector<float>& mfcc = gist.getMelFrequencyCepstralCoefficients();
=== 1.0.5 === (29th February 2020)
=== 1.0.4 === (22nd January 2017)
=== 1.0.3 === (17th June 2016)
=== 1.0.2 === (24th April 2016)
=== 1.0.1 === (26th June 2014)
=== 1.0.0 === (22nd June 2014)
The Gist library depends on one of the following FFT libraries:
You will need to install this yourself, link projects using -lfftw3 and use the flag -DUSE_FFTW
This is included with the project. To use Kiss FFT, add the flag -DUSE_KISS_FFT
To use Accelerate FFT, add the flag -DUSE_ACCELERATE_FFT
Copyright (c) 2014 Adam Stark
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
FAQs
Node binding for the Gist Audio Analysis Library
We found that @mathquis/node-gist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.