
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
Local-first CLI for turning online videos and local files into size-constrained GIFs.
gifvid is a local-first CLI for turning a URL or local media file into a size-constrained GIF, MP4, or WebM that is actually usable in Slack, docs, and the web.
The product shape is simple:
gifvid starts with the reliable primitives that already work on a real machine:
yt-dlp for URL-based ingestionffmpeg and ffprobe for clipping and renderingffmpegffprobeyt-dlp for URL inputsOn macOS with Homebrew:
brew install ffmpeg yt-dlp
Run without installing globally:
npx gifvid --help
Install globally:
npm install -g gifvid
With pnpm:
pnpm dlx gifvid --help
Inspect a source:
npx gifvid inspect "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
Make a Slack-sized GIF from a URL:
npx gifvid make "https://www.youtube.com/watch?v=dQw4w9WgXcQ" \
--start 0:42 \
--duration 4 \
--preset slack
Make a GIF from a local file with a hard size budget:
npx gifvid make ./clip.mp4 \
--start 1:03 \
--end 1:07 \
--preset web \
--max-bytes 3mb
Generate GIF, MP4, and WebM plus a manifest:
npx gifvid make ./clip.mp4 \
--start 1:03 \
--duration 4 \
--preset slack \
--format all
If a URL host requires a real browser session, let yt-dlp read local cookies:
npx gifvid make "https://www.youtube.com/watch?v=..." \
--browser chrome \
--start 0:15 \
--duration 3
gifvid inspect <input>Shows source metadata and rough preset estimates.
Useful flags:
--browser <profile> for URL sources that need browser cookies--json for structured outputgifvid make <input>Generates a clip asset from a URL or local media file.
Required:
--start <time>Choose one:
--end <time>--duration <time>Optional:
--preset <slack|web|tiny|hq>--format <gif|mp4|webm|all>--width <pixels>--fps <frames>--colors <count>--max-bytes <value>--browser <profile>--output-dir <path>--name <basename>--publish--jsonEvery make run writes a sidecar manifest:
<basename>.manifest.json
When --format all is used, the command emits:
<basename>.gif<basename>.mp4<basename>.webm<basename>.manifest.jsongifvid publish <file>Uploads an existing asset to Cloudflare R2.
Optional:
--key <bucket/key.gif>--jsonPublishing is optional and env-driven.
Required env vars:
GIFVID_R2_ACCOUNT_ID=...
GIFVID_R2_ACCESS_KEY_ID=...
GIFVID_R2_SECRET_ACCESS_KEY=...
GIFVID_R2_BUCKET=...
Optional:
GIFVID_R2_PUBLIC_BASE_URL=https://cdn.example.com/
GIFVID_R2_KEY_PREFIX=gifs
If GIFVID_R2_PUBLIC_BASE_URL is set, gifvid returns a shareable public URL after upload.
tiny: low-friction reaction GIFsslack: default preset for chat usageweb: bigger embed-friendly GIFshq: highest-quality GIF master before you need a tighter byte budgetEach preset defines:
If the first GIF render is too large, gifvid iterates downward on palette, fps, and width until it lands under budget or returns the smallest viable result.
yt-dlp setup and the target site's defenses.Source, docs, and the public site live at:
github.com/danielgwilson/gifvid
If you are working from the repo itself instead of the published package, the workspace root exposes:
pnpm cli make ...
FAQs
Local-first CLI for turning online videos and local files into size-constrained GIFs.
We found that gifvid demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.