
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

A tiny javascript library to turn byte arrays into efficient base64 strings.
Basically, this does what you wish btoa would do with an array of bytes, but doesn't. It's not complicated stuff, but there are some gotchas that this library takes care of for you. In tandem with msgpack, it's a great way to stuff a bunch of data into a url if you have to.
blob64.pack( msgpack.pack( ... ) ) beats btoa( JSON.stringify( ... ) by ~30-65%, depending on your data. (see below)
Compatable with nodejs, script tag includes, and requirejs.
blob64.js (1.0kB)
blob64.min.js (0.5kB)
npm install blob64
var buff = [150,205,135,2,206,0,52,217,33,206,0,52,212,203,206,0,83,93,251,206,2,45,175,212,206,1,101,218,187]
blob64.pack( buff )
// 40 chars (30.3% the size of native btoa)
// "ls2HAs4ANNkhzgA01MvOAFNd+84CLa/UzgFl2rs="
btoa( buff )
// note that this converts buff into a string "150,205,135" and then base64 encodes it
// 132 chars
// "MTUwLDIwNSwxMzUsMiwyMDYsMCw1MiwyMTcsMzMsMjA2LDAsNTIsMjEy
// LDIwMywyMDYsMCw4Myw5MywyNTEsMjA2LDIsNDUsMTc1LDIxMiwyMDYs
// MSwxMDEsMjE4LDE4Nw=="
btoa( JSON.stringify( buff ) )
// also 132 chars
// "WzE1MCwyMDUsMTM1LDIsMjA2LDAsNTIsMjE3LDMzLDIwNiwwLDUyLDIx
// MiwyMDMsMjA2LDAsODMsOTMsMjUxLDIwNiwyLDQ1LDE3NSwyMTIsMjA2
// LDEsMTAxLDIxOCwxODdd"
blob64.pack([0,0,0])
// "AAAA"
blob64.pack([255,255,255])
// "////"
blob64.pack([1,3,3,7])
// "AQMDBw=="
Compared to using atob / btoa.
btoa([0,0,0])
// "MCwwLDA="
btoa([255,255,255])
// "MjU1LDI1NSwyNTU="
btoa([1,3,3,7])
// "MSwzLDMsNw=="
var obj = {this:{is:{a:{msgpack:{object:'foo'}}}}};
var packed = blob64.pack( msgpack.pack( obj ) );
// "gaR0aGlzgaJpc4GhYYGnbXNncGFja4Gmb2JqZWN0o2Zvbw=="
msgpack.unpack( blob64.unpack( packed ) )
// {this:{is:{a:{msgpack:{object:'foo'}}}}}
// vs alternatives
btoa( JSON.stringify( obj ) )
// "eyJ0aGlzIjp7ImlzIjp7ImEiOnsibXNncGFjayI6eyJvYmplY3QiOiJmb28ifX19fX0="
btoa( msgpack.pack( obj ) )
// "MTI5LDE2NCwxMTYsMTA0LDEwNSwxMTUsMTI5LDE2MiwxMDUsMTE1LDEyOSwxNjEsOTcsMTI5LDE2NywxMDksMTE1LDEwMywxMTIsOTcsOTksMTA3LDEyOSwxNjYsMTExLDk4LDEwNiwxMDEsOTksMTE2LDE2MywxMDIsMTExLDExMQ=="
In the above examples, blob64 is 68% the size of JSON + btoa, the next closest competitor. This advantage increases quite a bit if your data has lots of integers in it.
Note: This is only especially useful in the browser, as it's functionality is the same as new Buffer([...]).toString('base64') on the server. But in the browser, it beats window.btoa by a nice margin.
MIT Licence
Contributions welcome
FAQs
convert byte arrays into efficient base64 encoded strings
We found that blob64 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.