
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@workos/alto
Advanced tools
Identity and platform access for applications running on Alto. See the application authoring guide for setup and runtime contracts.
Declare resources.images: [{ binding: "IMAGES" }] in alto.json and use
transformImage from version 0.12.0 or later:
import { transformImage } from "@workos/alto";
const image = await transformImage(env.IMAGES, sourceStream, {
format: "image/webp",
width: 128,
height: 128,
fit: "cover",
quality: 80,
});
The input is a ReadableStream<Uint8Array> and the output is a Response.
format is required and accepts image/webp or image/png. Width and height
are optional positive integers, fit accepts cover, and optional quality is
1–100. Fetch or read source bytes in the app and provide a fresh stream for each
output. Return the response to a browser or consume its bytes for storage.
The same helper uses Alto's transformation service in production and an offline native Images binding in local development. See the Images contract for declarations, migration examples, local setup and shared provider limits.
FAQs
Identity and platform access for apps running on Alto.
The npm package @workos/alto receives a total of 2,204 weekly downloads. As such, @workos/alto popularity was classified as popular.
We found that @workos/alto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.