
Research
/Security News
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.
@stll/anonymize-wasm
Advanced tools
PII detection and anonymization for browsers via WebAssembly. Same native SDK API as @stll/anonymize.
Browser-friendly build of @stll/anonymize.
Use this package when you need the runtime API in a browser or bundler environment. It ships the WebAssembly build and the Vite helper that keeps the wasm assets out of dependency pre-bundling.
bun add @stll/anonymize-wasm
The package exposes text, sessions, caller detections, PDF inspection, and prepared-package/config assembly through WebAssembly. Native filesystem loaders and local document-provider tools remain Node-only. The binding is instantiated lazily on first use.
import { createPipeline } from "@stll/anonymize-wasm";
const pipeline = await createPipeline({ language: "en" });
const { redaction } = pipeline.redactText("A contract signed by Jan Novak.");
console.log(redaction.redactedText);
createPipeline() accepts one supported language, an exact non-empty
combination such as { language: ["cs", "en"] }, or { language: "all" }.
Language-scoped pipelines are assembled and cached from lazy dictionary chunks;
"all" loads the bundled default prepared package.
Bring your own prepared package (bytes, an ArrayBuffer, or a URL to fetch):
import { loadPipeline } from "@stll/anonymize-wasm";
const pipeline = await loadPipeline(
new URL("./my-package.stlanonpkg", import.meta.url),
);
With Vite, register the helper plugin so the wasm binary, ESM glue, and
.stlanonpkg assets survive both dependency pre-bundling (dev) and a
production vite build (the plugin emits the native/ assets and rewrites the
runtime asset base to point at them):
import stllAnonymizeWasm from "@stll/anonymize-wasm/vite";
// vite.config: plugins: [stllAnonymizeWasm()]
By default the plugin emits every bundled prepared package into your build. The
full-dictionary default package alone is large (~20 MB), plus the per-language
cs, de, and en variants. If your app only needs some of them, restrict the
emitted packages with the packages option (the wasm binary and glue are
always emitted):
// Emit only the Czech scoped package.
stllAnonymizeWasm({ packages: ["cs"] });
// Emit the full-dictionary default plus English.
stllAnonymizeWasm({ packages: ["default", "en"] });
// Emit no prepared packages; the app supplies its own to loadPipeline().
stllAnonymizeWasm({ packages: "none" });
// Emit everything (the default).
stllAnonymizeWasm({ packages: "all" });
"default" selects the full-dictionary package that createPipeline() with
language: "all" or loadDefaultPipeline()
(no argument) loads; a language code selects the scoped package that
loadDefaultPipeline("cs") loads. Requesting a package that is not bundled
fails the build.
The semantic factory supports cs, de, en, es, fr, hu, it, lv,
pl, pt-br, ro, sk, and sv. The lower-level artifact loader has
bundled scoped packages for cs, de, and en only.
Interplay with the runtime loaders: the plugin only controls which assets ship,
not which the code asks for. Calling loadDefaultPipeline(language) for a
package you did not emit resolves to a missing asset URL and rejects with a
fetch error at runtime. Keep the packages list aligned with the languages your
app actually loads, or load your own package bytes through loadPipeline.
@stll/anonymize, running in WebAssembly.wasm32-unknown-unknown. It runs in ordinary
browser contexts without SharedArrayBuffer, Web Workers, COOP, or COEP.See the package's LICENSE and the repository root ATTRIBUTION.md for
dependency attribution.
The wasm binding is generated by wasm-bindgen and is not checked in:
cd packages/anonymize
bun run build:native-wasm # needs the wasm32-unknown-unknown Rust target
bun run build # tsdown + native node binding
bun run build:wasm-assets # copy glue + build compressed packages into wasm/dist/native
The wasm32-unknown-unknown target is pinned in rust-toolchain.toml, so
rustup installs it automatically; with a non-rustup toolchain run
rustup target add wasm32-unknown-unknown first.
FAQs
PII detection and anonymization for browsers via WebAssembly. Same native SDK API as @stll/anonymize.
The npm package @stll/anonymize-wasm receives a total of 45,704 weekly downloads. As such, @stll/anonymize-wasm popularity was classified as popular.
We found that @stll/anonymize-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

Research
/Security News
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.