
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
node-espeak-ng
Advanced tools
Node.js wrapper for eSpeak NG.
This package is licensed under the MIT License © Izhan.
It includes eSpeak NG, a free and open-source text-to-speech engine.
eSpeak NG is licensed under the GPLv3. For more details, visit the eSpeak NG GitHub repository.
with npm
npm install node-espeak-ng
with yarn
yarn add node-espeak-ng
with pnpm
pnpm install node-espeak-ng
with bun
bun install node-espeak-ng
const espeak = require("node-espeak-ng");
espeak.speak("Hello world");
// Specify voice
espeak.speak("Hello world", { voice: "en-us" });
// Specify pitch
espeak.speak("Hello world", { pitch: 50 });
// Specify speed
espeak.speak("Hello world", { speed: 150 });
// Combine options
espeak.speak("Hello world", { voice: "en-us", pitch: 70, speed: 140 });
const espeak = require("node-espeak-ng");
espeak.speakTerminal();
You can type text normally, or include options inline:
Hello world
voice:en-us Hello world
pitch:60 Hello world
speed:150 Hello world
voice:en-us pitch:70 speed:140 Hello world
voice → specify a voice e.g., mb/mb-us1
pitch → integer 0–99
speed → words per minute
FAQs
Node.js wrapper for eSpeak NG.
We found that node-espeak-ng demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.