
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
jaxcore-deepspeech-plugin
Advanced tools
Jaxcore is an open source cybernetic control system. This plugin connects Mozilla DeepSpeech to Jaxcore to enable speech recognition support and voice control of any device or service that is connected.
Related projects:
Together, these tools provide JavaScript developers an easy way write "Alexa-like" interactive voice assistants, smart-home controls, and create science-fiction like voice-controlled web applications and games. Run everything privately on your local computer without any 3rd party cloud computing services required.
npm install jaxcore-deepspeech-plugin
To install from source and try the examples:
git clone https://github.com/jaxcore/deepspeech-plugin
cd deepspeech-plugin
npm install
All the examples require the DeepSpeech english model to be at the root of the project.
# enter project directory
cd deepspeech-plugin
wget https://github.com/mozilla/DeepSpeech/releases/download/v0.6.0/deepspeech-0.6.0-models.tar.gz
tar xfvz deepspeech-0.6.0-models.tar.gz
rm deepspeech-0.6.0-models.tar.gz
If you have previously download the models a softlink can be made:
ln -s /path/to/deepspeech/models
The examples provided will demonstrate the capabilities and limitations of the system, and provide a good place to start when writing your own "voice apps".
These examples run directly in NodeJS:
These are more advanced NodeJS examples which use Jaxcore to control other devices and network services:
These use a ReactJS client to stream microphone audio from the browser to a NodeJS server running DeepSpeech:
These require running the Jaxcore Desktop Server and web browser extension. This method allows developers to write voice-enabled web applications using only client-side JavaScript. The Jaxcore application provides the speech recognition support from outside the browser.
This DeepSpeech plugin does not provide any audio recording functionality of it's own. The purpose of this library is to use VAD (voice activity detection) to stream audio data to an instance of DeepSpeech running in a background thread (fork) in the best way possible.
It is recommended to use BumbleBee Hotword or the NodeJS version of BumbleBee to provide record the microphone audio. These libraries have been tweaked specifically to work with DeepSpeech and has Porcupine hotword detection built-in for wake-word support.
The examples above demonstrate different ways to run BumbleBee to record and stream microphone audio into DeepSpeech.
For NodeJS, this is a basic way:
const Jaxcore = require('jaxcore');
const jaxcore = new Jaxcore();
jaxcore.addPlugin(require('jaxcore-deepspeech-plugin'));
const BumbleBee = require('bumblebee-hotword-node');
const bumblebee = new BumbleBee();
bumblebee.addHotword('bumblebee');
const MODEL_PATH = process.env.DEEPSPEECH_MODEL || __dirname + '/../../deepspeech-0.6.0-models'; // path to deepspeech model
jaxcore.startService('deepspeech', {
modelName: 'english',
modelPath: MODEL_PATH,
silencThreshold: 200, // delay for this long before processing the audio
vadMode: 'VERY_AGGRESSIVE', // 'AGGRESSIVE' or 'VERY_AGGRESSIVE' is recommended
}, function(err, deepspeech) {
// receive the speech recognition results
deepspeech.on('recognize', (text, stats) => {
console.log('recognize:', text, stats);
});
// bumblebee emits a "data" event for every 8192 bytes of audio it records from the microphone
bumblebee.on('data', function(data) {
// stream the data to the deepspeech plugin
deepspeech.streamData(data);
});
// bumblebee start the microphone
bumblebee.start();
});
The audio data streamed to DeepSpeech using deepspeech.streamData(data); Does not specifically have to be from a microphone using BumbleBee, the data can be any PCM integer 16 bit 16khz stream from any source.
To receive microphone audio from the browser through a websocket server, see the Web Basic example.
These methods are used to receive audio data from the browser or from an ElectronJS window:
Stream an audio buffer to the deepspeech plugin:
deepspeech.streamData(data);
End the stream:
deepspeech.streamEnd();
End the stream and ignore deepspeech results;
deepspeech.streamReset();
"recognize"
Receives the speech recognition results from DeepSpeech:
deepspeech.on('recognize', (text, stats) => {
console('recognize', text, stats);
});
0.0.6:
FAQs
Mozilla DeepSpeech speech recognition plugin for Jaxcore
We found that jaxcore-deepspeech-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.