
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
id3-ts-lib
Advanced tools
The fat-free ID3-only MPEG2TS segment generator library!
As a library (into your fancy project):
$> npm install @brightcove/id3-ts-lib
Usage:
const fs = require('fs');
// The whole library exposes just a single function:
const generateID3Segment = require('id3-ts-lib');
// If a PID is falsey, then that track will not be included in the generated PMT
const options = {
pmtPid: 0x100,
id3Pid: 0x103,
videoPid: null,
audioPid: null,
id3PTS: 282743,
data: 'This is just some example payload...',
};
// The function returns a promise that resolves to a buffer
generateID3Segment(options).then((segment) => {
fs.writeSync('test.ts', segment);
});
As a very rudimentary executable:
$> npm install -g @brightcove/id3-ts-lib
$> id3-ts 'This is just some example payload...' > test.ts
The entire segment construction process is performed using a single Buffer allocation. All operations are done in place including the ID3-creation which is "chunked" so that the ID3 can be created in-place "around" the TS packet headers. As a result, this code can generate an entire segment for a 4kb payload in about 9.6µs!
FAQs
An ID3-only MPEG2TS segment generator library.
The npm package id3-ts-lib receives a total of 4 weekly downloads. As such, id3-ts-lib popularity was classified as not popular.
We found that id3-ts-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 162 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.