
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@oseq/auma
Advanced tools
AUMA is a framework for creating augmented audio applications. The framework currently supports the following application types (optimized for mobile devices):
In general, an augmented audio application may be created by including a <script/> tag for the application type, and by then providing some minimal, application specific configuration. Scripts are available from the UNPKG CDN: https://unpkg.com/@oseq/auma/. This sounds a bit abstract, read on to understand more!
You create an augmented audio application with just a simple HTML file:
<!DOCTYPE html>
<html>
<head>
<!-- Include the AUMA script for this application type -->
<script src="SCRIPT"></script>
</head>
<body>
<!-- Configure & start the application -->
<script>
const appConfiguration = {
// YOUR_APP_CONFIGURATION
};
auma(appConfiguration);
</script>
</body>
</html>
You only need to make a few small adaptions:
SCRIPT with a link to the AUMA script for your application type.
YOUR_APP_CONFIGURATION to configure your specific application.For script and configuration information read the application type specific documentation below.
Script:
https://unpkg.com/@oseq/auma/dist/auma-survey.js
Configuration:
type SurveyConfiguration = {
id: string;
allowSkip?: boolean;
welcome: {
audioUrl: string;
};
questions: Array<{
id: string;
audioUrl: string;
imageUrl?: string;
}>;
// Result audio chosen based on survey score.
// Choose audio where `from<=score<=to`.
results: Array<{
from: number;
to: number;
audioUrl: string;
imageUrl?: string;
}>;
theme?: {
logoUrl?: string;
buttonYesBgColor?: string;
buttonYesFgColor?: string;
buttonNoBgColor?: string;
buttonNoFgColor?: string;
buttonSkipBgColor?: string;
buttonSkipFgColor?: string;
};
// Optional tracking function, will be called on key events.
trackFn?: (event: string, extraData: object) => void;
};
See demo/survey/ (npm run start-demo:survey) for an example survey implementation.
Script:
https://unpkg.com/@oseq/auma/dist/auma-decision-tree.js
Configuration:
type DecisionTreeConfiguration = {
id: string;
welcome: {
audioUrl: string;
};
questions: Array<{
id: string;
audioUrl: string;
imageUrl?: string;
// onYes/onNo are string directives of the form
// question:<questionId> or result:<resultId>
// e.g. onYes: "question:foo" to go to question with ID foo.
// e.g. onNo: "result:bar" to go to result with ID bar.
onYes: string;
onNo: string;
}>;
results: Array<{
id: string;
audioUrl: string;
imageUrl?: string;
}>;
theme?: {
logoUrl?: string;
buttonYesBgColor?: string;
buttonYesFgColor?: string;
buttonNoBgColor?: string;
buttonNoFgColor?: string;
};
};
See demo/decision-tree/ (npm run start-demo:decision-tree) for an example decision tree implementation.
Requirements:
# install the development dependencies
npm install
# run a demo e.g. survey
npm run start-demo:survey
# see package.json "scripts" section for more.
Releasing:
npm run build
npm version patch
npm publish
Here we created a patch version. For now this probably makes the most sense - we should stay at major version v0 unless we plan to make strong compatibility guarantees. Hence it is especially important that consumers include explicitly the specific version of the script they use.
Deploying the demo:
npm run deploy-demo
Demo is currently deployed with https://surge.sh/. Collaborators can be added using the --add flag https://surge.sh/help/adding-collaborators/.
FAQs
Augmented Audio Framework (AUMA).
We found that @oseq/auma demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.