
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
In many protocols or formats like JSON or early WebSocket, it requires String in UTF-8 representation, so we can not store raw binary data into String without encoding like Base64.
However, Base64 encodes binary into only 6 bits space but we can actually use one more bit in valid UTF-8 string from U+0000 to U+007F, so using Base128 is better than Base64 (~ 16% more information we can store in the same space.)
This Base128 module provides simple encode, decode interfaces between Buffer and String on Node.js which are implemented in C++.
Use npm to grab a package then load by require().
$ npm install base128
$ node
> var base128 = require('base128')
To Encode,
var base128 = require('base128')
var binary = new Buffer([0xFF, 0x01])
var string = base128.encode(binary)
console.log(string) #=> '\u007F\u0003\u0000' (These cahracters are invisible, though.)
To Decode,
var base128 = require('base128')
var string = '\u007F\u0003\u0000'
var binary = base128.decode(string)
console.log(binary) #=> '<Buffer ff 01>'
Base128 is using NAN to build native add-on binary for Node.js.
npm install does everything for you, but there are extra scripts defined in package.json.
$ npm run clean # Cleanup build files
$ npm run distclean # Cleanup all generated files
$ npm run build # Build native add-on binary
To test Base128,
$ npm test
FAQs
Encode, decode binary to/from UTF-8 string using Base128.
We found that base128 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.