
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@stinkycomputing/sesame-api-client
Advanced tools
Sesame API client library with protobuf definitions and command list helpers
Official TypeScript/JavaScript client library for the Sesame video production server.
npm install @stinkycomputing/sesame-api-client
For Node.js applications that need the full RPC client:
import { SesameClient, CommandList } from '@stinkycomputing/sesame-api-client';
// Create client
const client = new SesameClient(8080);
// Build command list
const cl = new CommandList();
cl.add_source('my-source', {
type: 'file',
path: '/path/to/video.mp4'
});
cl.add_compositor('main', 1920, 1080, false);
// Execute commands
await client.execute(cl);
// Listen to events
client.on('status', (status) => {
console.log('Status update:', status);
});
For browser applications that only need protobuf types (e.g., for decoding messages from WebSocket):
import { Sesame } from '@stinkycomputing/sesame-api-client/browser';
// Decode a status message received from WebSocket
const statusBytes = new Uint8Array(data);
const status = Sesame.PB.StatusMessage.decode(statusBytes);
const statusObj = Sesame.PB.StatusMessage.toObject(status, { longs: Number });
console.log('Status:', statusObj);
Browser entry point (/browser) includes:
Sesame, sesame, Message)CommandList helperSesameBinaryProtocol utilitiesevents, ws)RPCClient or SesameConnection classesThe legacy API uses the Sesame.PB namespace:
import { Sesame } from '@stinkycomputing/sesame-api-client';
const msg: Sesame.PB.AddSourceMessage = {
id: 'source1',
type: Sesame.PB.SourceType.ST_FILE,
// ...
};
The new API is organized into domain-specific modules:
import { sesame } from '@stinkycomputing/sesame-api-client';
const msg: sesame.v1.sources.SourceAddRequest = {
id: 'source1',
type: sesame.v1.sources.SourceType.SOURCE_TYPE_FILE,
// ...
};
sesame.v1.common - Common types (Empty, Vec4, PropValue, etc.)sesame.v1.sources - Source managementsesame.v1.outputs - Output managementsesame.v1.compositor - Compositor and scene graphsesame.v1.audio - Audio mixersesame.v1.recorder - Recorder and clipssesame.v1.jobs - Background jobs (export/import)sesame.v1.status - Status and eventssesame.v1.commands - Command list systemsesame.v1.rpc - RPC protocolThe CommandList class provides a fluent API for building command sequences:
const cl = new CommandList();
// Add source
cl.add_source('cam1', {
type: 'decklink',
deviceIndex: 0
});
// Add compositor
cl.add_compositor('main', 1920, 1080, false);
// Add node to compositor
cl.add_node('main', 'cam1-node', 'source', {
sourceId: 'cam1'
});
// Set properties
cl.set_property(
{ compositor: 'main', node: 'cam1-node' },
'transform',
'position',
{ vecValue: { r: 100, g: 100 } }
);
// Transport control
cl.add_transport_command('cam1', { type: 'play' });
// Execute all commands
await client.execute(cl);
When using this package in a bundled application (e.g., with esbuild):
@stinkycomputing/sesame-api-client in your bundle for zero-dependency deploymentws, bufferutil, utf-8-validate)npm install the native dependencies in productionThis approach gives you:
MIT
FAQs
Sesame API client library with protobuf definitions and command list helpers
We found that @stinkycomputing/sesame-api-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.