
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
# Stable... and the development one (unstable)...
# Using NPM
npm install hoshimi # Stable
npm install https://github.com/Ganyu-Studios/Hoshimi.git # Development
# Using PNPM
pnpm install hoshimi
pnpm install https://github.com/Ganyu-Studios/Hoshimi.git
# Using YARN
yarn add hoshimi
yarn add https://github.com/Ganyu-Studios/Hoshimi.git
# Using BUN
bun add hoshimi
bun add https://github.com/Ganyu-Studios/Hoshimi.git
You can read this or you can follow this one:
import { Hoshimi } from "hoshimi"; // She is all ears!
import { Client } from "seyfert"; // Only example client, you can use whatever you want...
const client = new Client(); // https://www.seyfert.dev/guide
const hoshimi = new Hoshimi({
nodes: [
{
host: "localhost",
port: 2333,
password: "youshallnotpass",
},
], // Add more nodes if you want!
sendPayload(guildId, payload) {
// Your client send to shard payload function
client.gateway.send(client.gateway.calculateShardId(guildId), payload);
},
});
// Bind the manager into your client!
client.hoshimi = hoshimi;
// FOLLOW YOUR CLIENT EVENT IMPLEMENTATION
// THIS IS ONLY A EXAMPLE, NOT A REAL USAGE
client.events.values.READY = {
__filePath: null,
data: { name: "ready", once: true },
run(user, client) {
client.logger.info(`Logged in as ${user.username}`);
// Call the manager to initialize hoshimi
hoshimi.init({ ...user, username: user.username });
},
};
client.events.values.RAW = {
__filePath: null,
data: { name: "raw" },
async run(data, client) {
// Call the handler on the gateway dispatch events
await hoshimi.updateVoiceState(data);
},
};
(async () => {
await client.start();
})();
I am currently working on this package.
This package takes some ideas provided from libraries like:
lavalink-clientkazagumodistubediscord-playershoukakuI'm taking their job as a base for this project, I love their job, all of them, I just took some
stuff because i'm too lazy to make my own.
If anyone of them wants to
talk to me to remove their stuff, they can.
But made with my code style and my knowledge and of course up-to-date.
Copyright © 2025 Ganyu Studios.
This project is MIT licensed.
Made with 🐐❤️💪... A project made by the community, for the community.
FAQs
A lavalink@v4 client easy to use, up-to-date and all ears.
The npm package hoshimi receives a total of 1,022 weekly downloads. As such, hoshimi popularity was classified as popular.
We found that hoshimi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.