
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@mux/convex
Advanced tools
A reusable Convex component for apps that use Mux for video. Sync your Mux video data with Convex and build video apps with a real-time database backing your catalog.
This package gives you:
assets, uploads, liveStreams, and eventsvideoMetadata storage (userId, title, visibility, tags, custom fields)@mux/convex-mux-init, to scaffold app-level Convex wrappers (npx convex-mux-init)npm i @mux/convex @mux/mux-node
npm i -D @mux/convex-mux-init
If you prefer not to install the scaffold CLI, you can run it directly with
npx:
npx @mux/convex-mux-init@latest --component-name mux
npx convex-mux-init --component-name mux
# or without installing it
npx @mux/convex-mux-init@latest --component-name mux
This creates:
convex/convex.config.tsconvex/migrations.tsconvex/muxWebhook.tsconvex/muxHttp.tsconvex/http.ts if your app does not already have oneIf files already exist, the CLI skips them unless you pass --force.
Existing convex/http.ts is never overwritten.
npx convex env set MUX_TOKEN_ID <your_mux_token_id>
npx convex env set MUX_TOKEN_SECRET <your_mux_token_secret>
npx convex dev
npx convex run migrations:backfillMux '{}'
If npx convex-mux-init created convex/http.ts for you, this is already
done.
If your app already had convex/http.ts, wire the generated helper into your
existing router:
import { httpRouter } from "convex/server";
import { registerMuxHttpRoutes } from "./muxHttp";
const http = httpRouter();
registerMuxHttpRoutes(http);
export default http;
In the Mux dashboard, create a webhook endpoint:
https://<your-deployment>.convex.site/mux/webhook/mux/webhookCopy the webhook signing secret and set it in Convex:
npx convex env set MUX_WEBHOOK_SECRET <your_mux_webhook_secret>
Tables to check:
assetsuploadsliveStreamseventsvideoMetadataWithout webhooks, data will drift over time.
This follows Convex component best practices:
@mux/convex is component-only (schema, queries, mutations)@mux/convex-mux-init is the separate CLI package that scaffolds those app-level files for youIf you mount with a different name, for example:
app.use(mux, { name: "videoInfra" });
Then regenerate wrappers with the matching name:
npx convex-mux-init --component-name videoInfra --force
# regenerate wrappers
npx convex-mux-init --component-name mux --force
# run backfill with options
npx convex run migrations:backfillMux '{"maxAssets":500,"defaultUserId":"dev-user-1","includeVideoMetadata":true}'
# run against prod deployment
npx convex run --prod migrations:backfillMux '{"maxAssets":500}'
Could not find function for 'migrations:backfillMux': Ensure convex/migrations.ts exists and exports backfillMux, then run npx convex dev.InvalidReference ... does not export [mux_node.backfillAssets]: Do not call components.<name>.mux_node.* directly. Use the app-level wrappers generated by npx convex-mux-init.webhooks.unwrap ... Record<string, unknown>: Regenerate wrappers with npx convex-mux-init --force.request.headers.entries is not a function/property: Build headers with request.headers.forEach(...) in convex/muxHttp.ts.ingestMuxWebhook is generated as internalAction, call it via internal.muxWebhook.ingestMuxWebhook (not anyApi.*).Node APIs without "use node": Ensure Node runtime files start with "use node";.node:fs / node:path from @mux/convex/bin/*: Upgrade to the split packages and use @mux/convex-mux-init as the separate scaffold CLI.FAQs
Convex Component for syncing Mux video data and app metadata.
We found that @mux/convex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.