
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@stemplayer-js/stemplayer-js
Advanced tools
A streaming, low latency Stem Player Web-Component
A streaming, low latency Stem Player Web-Component
See this live example of our stem player
This webcomponent follows the open-wc recommendation.
This repo is a subtree split of our monorepo. Using a monorepo greatly simplifies development of many packages with dependencies. If you'd like to contribute to the development of stemplayer-js, please create a pull-request there.
npm i @stemplayer-js/stemplayer-js
<script type="module">
import '@stemplayer-js/stemplayer-js/element.js';
</script>
<stemplayer-js>
<stemplayer-js-controls label="A label"></stemplayer-js-controls>
<stemplayer-js-stem
label="Drums A"
src="https://your-cdn-com/drums.m3u8"
waveform="https://your-cdn-com/drums.json"
volume="0.1"
>
</stemplayer-js-stem>
<stemplayer-js-stem
label="Vocals"
src="https://your-cdn-com/vocals.m3u8"
waveform="https://your-cdn-com/vocals.json"
muted="true"
volume="0.2"
></stemplayer-js-stem>
</stemplayer-js>
See here for further options, events and CSS variables
The Player works in browsers supporting the Web Audio API. This includes most modern browsers.
The stem player is built as a web-component which is supported natively by most modern browsers.
For targeting older browsers, you can utilise your own build system.
Polyfills for web-components exist for support for older browsers.
The player consumes m3u8 playlist files known from the HLS protocol.
The audio is split up into chunks and served (over simple HTTP) separately.
Why HLS and not just download whole files? Downloading and decoding, for example, 10 5minute audio files will consume bandwith and bloat memory: each minute of every audio file worth of mp3 data is decoded into 44k PCM data and will consume roughly 100mb. By using live streaming we not only speed up playback, we also reduce the memory footprint.
Why not progressive download? We need to use the web audio API to achieve precise synchronized playback.
See also
See also this Docker image to help you segment your audio.
If you have an AWS environment, we have also created a Serverless Backend that will do this for you.
Because we don't download the entire audio file, we cannot analyse the audio so that we can display a nice waveform. So unfortunately these also need to be pre-generated. Although inconvenient, it is probably good practice anyway as a waveform in json format is very small in size; there is no need to re-compute it time and time again.
See here for info on how to generate compatible waveforms. Make sure you limit the --pixels-per-second
to around 20
, since by default the library will output that contains too much detail.
The output will have to be normalized so the waveform will be represented by an array of numbers that is between -1 and +1.
See here for a Docker image which should (hopefully) help.
If you have an AWS environment, we have also created a Serverless Backend that will do this for you.
To scan the project for linting and formatting errors, run
npm run lint
To automatically fix linting and formatting errors, run
npm run format
To execute a single test run:
npm run test
To run the tests in interactive watch mode run:
npm run test:watch
For most of the tools, the configuration is in the package.json
to minimize the amount of files in your project.
If you customize the configuration a lot, you can consider moving them to individual files.
web-dev-server
npm start
To run a local development server that serves the basic demo located in demo/index.html
4.0.0-beta.3 (2025-07-18)
Note: Version bump only for package @stemplayer-js/stemplayer-js
FAQs
A streaming, low latency Stem Player Web-Component
We found that @stemplayer-js/stemplayer-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.