
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
audio-decode-wasm
Advanced tools
Note: This doesn't work quite yet, but the structure is drafted out.
A stream that decodes ArrayBuffers into AudioBuffers. The decoders are made in WebAssembly so they are portable (Node.js and browser) and decent speed.
const decoder = require('audio-decode-wasm')
// Obtain codec module and initialize decoder:
const mod = await fetch('wav.wasm').then(req => WebAssembly.compileStreaming(res))
const decode = await decoder(mod)
// Decode ArrayBuffers:
decode(arrayBuf, (err, audioBuf) => {
// ...
})
npm i -D audio-decode-wasm
decoder(mod) -> Promise<decode>Initializes a decoder from a given [WebAssembly.Module]. The available ones
can be seen in src/.
const mod = new WebAssembly.Module(...)
decoder(mod).then(decode => {
// ...
})
decode(arrayBuffer, done)Decodes arrayBuffer and calls done(err, audioBuffer) when finished.
To stop or "reset" the stream send decode(null).
const decode = await decoder(mod)
fetch('foo.wav')
.then(res => res.arrayBuffer())
.then(buf => {
decode(buf, (err, audio) => {
// ...
})
})
Promise.all([
decoder(...),
decoder(...)
]).then(([ wav, mp3, ... ]) => {
// ...
})
The decoders are wrote in C and compiled with Emscripten. The code is more restricted than a normal Emscripten runtime so it's cheap to load.
Each C modules has the functions
Context* open(unsigned char* input, float* output)
void process(Context* context, int amount)
From JS you can create the context with _open(input, output), where the parameters and return values are pointers on WebAssembly's memory, which JS can access and modify.
The Context from C looks like:
typedef struct {
unsigned char* input;
float* output;
uint16_t number_of_channels;
uint32_t sample_rate;
unsigned char params;
// ...
} Context;
To construct an AudioBuffer you need numberOfChannels and sampleRate, so JS imports a set_params(int, int) function which C can call.
The stream routine would look like this:
ArrayBuffer into WebAssembly's input buffer.Float32Arrays into an AudioBuffer.Requires Emscripten, Binaryen, and WABT. Then, using make:
make to create dist/make debug to produce dist/*.watmake clean to remove outputFAQs
Decode streams of audio with WebAssembly.
The npm package audio-decode-wasm receives a total of 2 weekly downloads. As such, audio-decode-wasm popularity was classified as not popular.
We found that audio-decode-wasm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.