
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Convert loaded GLTF models to VRM 0.x or 1.0 in memory (browser or Node.js). This package allows you to convert a loaded GLTF (from THREE.GLTFLoader or similar) to a VRM file buffer, with custom bone and blendshape mapping, and output a VRM GLB ready for use with three-vrm, UniVRM, and other tools.
npm install gltf2vrm
You must also have three installed as a peer dependency.
import { GLTFLoader } from 'three/examples/jsm/loaders/GLTFLoader';
import { convertGLTFToVRM } from 'gltf2vrm';
const loader = new GLTFLoader();
loader.load('path/to/model.glb', (gltf) => {
const boneMap = {
hips: 5,
spine: 6,
head: 10,
leftUpperArm: 15,
rightUpperArm: 20,
// ... map all required bones
};
const blendShapeMap = {
happy: 0,
sad: 1,
// ...
};
const meta = {
name: 'My VRM Model',
author: 'Your Name',
};
const vrmBuffer = convertGLTFToVRM({
gltf,
boneMap,
blendShapeMap,
meta,
version: '1.0', // or '0.x'
});
// Use vrmBuffer (save, upload, or load with three-vrm)
});
See examples/convert-gltf-to-vrm.ts for a more detailed example. Uncomment and adapt the imports as needed for your environment.
convertGLTFToVRM(options): ArrayBufferOptions:
gltf (required): The loaded GLTF object (output of THREE.GLTFLoader)boneMap (required): Object mapping VRM bone names to GLTF node indicesblendShapeMap (optional): Object mapping VRM expression names to morph target indicesmeta (optional): Object with VRM metadata fields (name, author, etc.)version (optional): '1.0' (default) or '0.x'Returns:
ArrayBuffer containing the VRM GLBVRMC_vrm extension)VRM extension)three (peer dependency)TextEncoder/TextDecoder if not availableGPL 3.0 License. See LICENSE for details.
FAQs
Convert loaded GLTF models to VRM 0.x or 1.0 in memory (browser/Node.js)
We found that gltf2vrm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.