
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
node-lightnpng
Advanced tools
Converts a Buffer to PNG format -- very, very quickly.
It's pronounced: "lightn--PING!". As in, PING! Your PNG is ready before you can say lightning.
First, install it in your project: npm install --save node-lightnpng
Then use it.
'use strict'
// For this example, we'll build an ARGB Buffer with node-canvas:
// https://github.com/Automattic/node-canvas
const Canvas = require('canvas')
const canvas = new Canvas(640, 480)
const ctx = canvas.getContext('2d')
ctx.fillStyle = 'red'
ctx.fillRect(10, 10, 200, 340)
ctx.fillStyle = 'green'
ctx.fillRect(50, 50, 30, 400);
const cairoBuf = canvas.toBuffer('raw') // ARGB, native-endian data
// Now's where this library comes in: let's create a PNG!
const lightnpng = require('node-lightnpng')
var png = lightnpng.native_argb32_to_png(
cairoBuf,
640, // width (in px)
480, // height (in px)
canvas.stride // number of bytes per row of image
)
We start with zero features.
Features that don't inhibit speed are great.
For features that do slow things down, apply the rule: a 5 percent slowdown should make this library useful to three times as many people as already use it.
Basically, we allow no options at all ... except:
Some drawing libraries may align their arrays to machine word boundaries.
The stride option specifies how many bytes are in each row.
BSD-style 2-clause license
FAQs
Converts a Buffer to PNG format -- very, very quickly.
The npm package node-lightnpng receives a total of 0 weekly downloads. As such, node-lightnpng popularity was classified as not popular.
We found that node-lightnpng demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.