
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Node.js bindings for the Intel Storage Acceleration Library (ISA-L), providing high-performance compression and decompression for GZIP, DEFLATE, and ZLIB formats.
I built this largely with the help of claude-code.
npm install isal-node
The package automatically detects your platform and either:
If no pre-built binary is available, the package will build from source. You'll need:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs/ | sh)xcode-select --install)sudo apt-get install build-essential)const isal = require('isal-node');
// Simple compression/decompression
const data = Buffer.from('Hello, World!');
// GZIP (Node.js zlib compatible)
const gzipped = isal.gzip(data);
const ungzipped = isal.gunzip(gzipped);
// DEFLATE (Node.js zlib compatible)
const deflated = isal.deflate(data);
const inflated = isal.inflate(deflated);
// With Sync suffix (Node.js zlib compatible)
const gzippedSync = isal.gzipSync(data);
const ungzippedSync = isal.gunzipSync(gzippedSync);
// ZLIB (additional formats)
const compressed = isal.compress(data);
const decompressed = isal.decompress(compressed);
const isal = require('isal-node');
async function compressData() {
const data = Buffer.from('Hello, World!');
// GZIP (Node.js zlib compatible naming)
const gzipped = await isal.gzipAsync(data);
const ungzipped = await isal.gunzipAsync(gzipped);
// DEFLATE (Node.js zlib compatible naming)
const deflated = await isal.deflateAsync(data);
const inflated = await isal.inflateAsync(deflated);
// ZLIB (additional formats)
const compressed = await isal.compressAsync(data);
const decompressed = await isal.decompressAsync(compressed);
}
// Parallel compression for better performance
async function compressMultiple(dataArray) {
const promises = dataArray.map(data => isal.gzipAsync(data));
const compressed = await Promise.all(promises);
return compressed;
}
Sync:
gzip(input, options?) - Compress using GZIPgunzip(input) - Decompress GZIP datadeflate(input, options?) - Compress using DEFLATEinflate(input) - Decompress DEFLATE datagzipSync(input, options?) - Compress using GZIP (explicit sync)gunzipSync(input) - Decompress GZIP data (explicit sync)deflateSync(input, options?) - Compress using DEFLATE (explicit sync)inflateSync(input) - Decompress DEFLATE data (explicit sync)Async:
gzipAsync(input, options?) - Compress using GZIP (async)gunzipAsync(input) - Decompress GZIP data (async)deflateAsync(input, options?) - Compress using DEFLATE (async)inflateAsync(input) - Decompress DEFLATE data (async)Additional Formats:
compress(input, options?) - Compress using ZLIBdecompress(input) - Decompress ZLIB datacompressAsync(input, options?) - Compress using ZLIB (async)decompressAsync(input) - Decompress ZLIB data (async)level - Compression level (0, 1, or 3). Default: 3
npm install
npm run build
npm test # Run synchronous tests
npm run test:async # Run asynchronous tests
npm run test:all # Run all tests
Run benchmarks to compare performance against Node.js built-in zlib:
npm run benchmark - Full benchmark with multiple data sizes and typesnpm run benchmark:quick - Quick benchmark with smaller data setsnpm run benchmark:async - Async vs sync performance comparisonMIT
FAQs
Node.js bindings for Intel Storage Acceleration Library (ISA-L) compression
The npm package isal-node receives a total of 1,615 weekly downloads. As such, isal-node popularity was classified as popular.
We found that isal-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.