
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@thetalabs/node-ffmpeg-installer
Advanced tools
Platform independent binary installer of FFmpeg for node projects
Platform independent binary installer of FFmpeg for node projects. Useful for tools that should "just work" on multiple environments.
Installs a binary of ffmpeg for the current platform and provides a path and version. Supports Linux, Windows and Mac OS/X.
A combination of package.json fields optionalDependencies, cpu, and os let's the installer only download the binary for the current platform. See also "Warnings during install", below.
npm install --save @ffmpeg-installer/ffmpeg
const ffmpeg = require('@ffmpeg-installer/ffmpeg');
console.log(ffmpeg.path, ffmpeg.version);
const ffmpegPath = require('@ffmpeg-installer/ffmpeg').path;
const spawn = require('child_process').spawn;
const ffmpeg = spawn(ffmpegPath, args);
ffmpeg.on('exit', onExit);
const ffmpegPath = require('@ffmpeg-installer/ffmpeg').path;
const ffmpeg = require('fluent-ffmpeg');
ffmpeg.setFfmpegPath(ffmpegPath);
To automatically choose the binary to install, optionalDependencies are used. This currently outputs warnings in the console, an issue that is tracked by the npm team here.
If you get permissions issues, try adding a .npmrc file with the following:
unsafe-perm=true
See issue #21
It's a known issue that Asar breaks native paths. As a workaround, if you use Asar, you can do something like this:
const ffmpegPath = require('@ffmpeg-installer/ffmpeg').path.replace('app.asar', 'app.asar.unpacked');
If you need to install a version of ffmpeg that differs than your current platform (e.g. compiling a Linux version to upload to AWS Lambda from MacOS), you can use npm install @ffmpeg-installer/linux-x64 --force (substituting linux-x64 with whatever platform you need). Note that if you are compressing your project into a .zip for Lambda, you will need to exclude the other platforms' builds from your archive.
Downloaded from the sources listed at ffmpeg.org:
For version updates, submit issue or pull request.
In every updated platforms/* directory:
npm run upload
FAQs
Platform independent binary installer of FFmpeg for node projects
We found that @thetalabs/node-ffmpeg-installer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.