
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@opensite/img
Advanced tools
High‑performance, native‑like dynamic img rendering engine for the OpenSite ecosystem. It accepts a numeric mediaId, fetches the optimal variants from the DashTrack CDN, and renders the best source for the viewer’s device and browser. It wraps the srcset variants list inside a <picture> tag and can be treated like a standard html <img> tag.
Key points
<picture> element (no wrapper, no default styles).<img> props and ref; drop‑in replacement.Core (required):
pnpm install @opensite/img
Minimal (progressive playback, tiny bundle):
import { Image } from '@opensite/img';
export function Hero({ mediaId }: { mediaId: number }) {
return (
<Image
mediaId={mediaId}
className="hero-video"
/>
);
}
Upgrade to adaptive streaming only on user interaction (e.g., first play):
<Video mediaId={mediaId} controls streamingOnInteraction />
Force adaptive streaming immediately (if available):
<Video mediaId={mediaId} controls adaptiveStreaming />
Prefer a progressive codec/size (optional):
<Video mediaId={mediaId} preferCodec="WEBM" preferSize="medium" />
Poster behavior:
poster={"https://…"} → use provided URL.poster={false} → disable poster entirely.cover.url from CDN payload if provided.Required
mediaId: number — DashTrack media record ID used to fetch the media snapshot.Optional
cdnHost?: string — Override CDN origin. Default: https://cdn.ing.adaptiveStreaming?: boolean — Immediately attach HLS/DASH adapter when applicable.streamingOnInteraction?: boolean — Progressive first, upgrade on first play.streamingUpgrade?: boolean — Allow upgrades at all (default: true). Set false to force progressive.preferCodec?: 'HLS' | 'DASH' | 'WEBM' | 'MP4' — Preferred codec when multiple are present.preferSize?: 'tiny' | 'small' | 'medium' | 'large' | 'xlarge' — Preferred progressive size variant.poster?: string | false — Poster override or disable; omitted defaults to CDN cover.url.onImageData?: (data: ImageData) => void — Callback when CDN payload is loaded.<video> attributes (e.g., controls, muted, playsInline, style, className, etc.).Direct src fallback
mediaId and provide src to play a direct progressive asset (MP4/WebM). In this mode, no CDN request is performed and streaming adapters are not attached.Ref
ref to the underlying <video> element for direct control and event subscriptions.https://cdn.ing/assets/videos/<mediaId>.cdnHost prop; path shape is fixed by the module.Expected payload (subset)
type ImageData = {
id: number;
cover?: { url: string; width?: number; height?: number };
variants_data: {
variants: {
HLS?: { cdn_master_playlist_url: string; rungs?: { bandwidth?: number; resolution?: string; codecs?: string }[] };
DASH?: { cdn_manifest_url: string; rungs?: { bandwidth?: number; resolution?: string; codecs?: string }[] };
PROGRESSIVE_MP4?: Partial<Record<'tiny'|'small'|'medium'|'large'|'xlarge', string>>;
WEBM?: Partial<Record<'tiny'|'small'|'medium'|'large'|'xlarge', string>>;
};
};
};
Order of preference (auto mode)
application/vnd.apple.mpegurl.hls.js or dashjs when allowed.You can override with preferCodec and preferSize as hints; the component will still ensure the final result is playable on the current browser.
adaptiveStreaming — Attach streaming adapter immediately if an HLS or DASH manifest exists and the browser needs an adapter.streamingOnInteraction — Keep progressive first, then upgrade on first play event (recommended to minimize initial JS).streamingUpgrade={false} — Disable all upgrades and stick to progressive assets.Adapters (dynamic imports)
hls.js via src/streaming/hls-adapter.dashjs via src/streaming/dash-adapter.These imports happen only when required by the chosen streaming path.
<video> element.<div> and no default CSS are applied.className, inline style, utility classes, etc.).Example
<Video mediaId={mediaId} className="w-full h-auto rounded-xl shadow" />
useEffect, so nothing runs on the server.<video>; sources are applied after mount.poster explicitly so it shows before the CDN payload loads.Types are exported from the root module:
import type { ImageData, PreferredCodec, PreferredSize } from '@opensite/video';
Useful types
ImageData, Variants, VariantRungBrowserCapabilities, SelectedSourcePreferredCodec, PreferredSizeRecommended
import { Video } from '@opensite/video';
Sub‑paths (advanced)
@opensite/video/core — capability/source helpers@opensite/video/streaming/hls — HLS adapter (dynamic import normally handles this)@opensite/video/streaming/dash — DASH adapter (dynamic import normally handles this)Package.json sets sideEffects: false and an exports map for optimal tree‑shaking.
Hero/Background (progressive only)
<Video mediaId={mediaId} autoPlay muted loop controls={false} preload="metadata" streamingUpgrade={false} />
Interactive B‑Roll (upgrade on play)
<Video mediaId={mediaId} controls streamingOnInteraction />
Short‑Form (full streaming)
<Video mediaId={mediaId} controls adaptiveStreaming />
Custom poster and sizing
<Video mediaId={mediaId} poster="https://cdn.example.com/posters/123.jpg" style={{ aspectRatio: '16 / 9', width: '100%' }} />
Using a ref
const ref = useRef<HTMLVideoElement>(null);
<Video mediaId={mediaId} controls ref={ref} />
// later
ref.current?.play();
Accessibility (reduced motion)
const prefersReducedMotion = window.matchMedia?.('(prefers-reduced-motion: reduce)').matches;
<Video mediaId={mediaId} autoPlay={!prefersReducedMotion} muted loop />
mediaId and network tab for the CDN request.hls.js and/or dashjs.adaptiveStreaming or streamingOnInteraction is set.poster is omitted and the payload has no cover.url, no poster will be used.src/core/.src/streaming/ and are imported dynamically.src/utils/api.ts with lightweight caching.ECOSYSTEM_GUIDELINES.md.Private module for the OpenSite ecosystem.
FAQs
OpenSite optimal img component with dynamic srcset generation
We found that @opensite/img demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.