
Security News
Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.
Check if a Buffer/Uint8Array is a PNG image
$ npm install is-png
import {readChunk} from 'read-chunk';
import isPng from 'is-png';
const buffer = await readChunk('unicorn.png', {length: 8});
isPng(buffer);
//=> true
import isPng from 'is-png';
const response = await fetch('unicorn.png');
const buffer = await response.arrayBuffer();
isPng(new Uint8Array(buffer));
//=> true
Accepts a Buffer (Node.js) or Uint8Array. Returns a boolean of whether buffer is a PNG image.
The buffer to check. It only needs the first 8 bytes.
The image-type package detects the file type of a buffer, supporting various image formats including PNG, JPEG, GIF, and more. It provides broader functionality compared to is-png, which is specific to PNG images.
The file-type package is a comprehensive utility for detecting the file type of a buffer or stream. It supports a wide range of file formats, including images, videos, documents, and more. It offers more extensive functionality compared to is-png, which is focused solely on PNG images.
The is-jpg package is similar to is-png but is specific to JPEG images. It allows you to check if a given buffer or file is a JPEG image, providing similar functionality but for a different image format.
FAQs
Check if a Buffer/Uint8Array is a PNG image
The npm package is-png receives a total of 796,180 weekly downloads. As such, is-png popularity was classified as popular.
We found that is-png demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.

Company News
Socket was named to the Rising in Cyber 2026 list, recognizing 30 private cybersecurity startups selected by CISOs and security executives.