
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Reactive/Adaptive soundtracks for the web.
notator is built on top of the Web Audio API, which is still in the working draft stage. All modern browsers are supported.
![]() | ![]() | ![]() | ![]() | ![]() | ![]() |
|---|---|---|---|---|---|
| 33+ ✅ | 29+ ✅ | 20+ ✅ | 7.1+ ✅ | 12+ ✅ | ❌ |
yarn add notator
npm i notator --save
import {
defaultContext,
Timeline,
Track,
Part,
Sound,
} from 'notator';
import drums from './path/to/drums.mp3';
import arp from './path/to/arp.mp3';
import click from './path/to/click.mp3';
const timeline = new Timeline({
bpm: 65,
});
const part = new Part({
duration: 1, // duration in bars
tracks: [
new Track({
duration: 1,
src: drums,
}),
new Track({
duration: 1,
src: arp,
}),
],
});
const sound = new Sound({
src: click,
quantize: 1 / 16,
gain: 2, // boost volume
});
someElement.addEventListener( 'click', () => {
defaultContext.start()
.then( () => timeline.cue( part ) );
});
document.addEventListener( 'click', () => {
timeline.play( sound );
});
Audio effects can be added to Timelines, Parts, Tracks and Sounds.
import {
defaultContext,
Timeline,
Track,
Part,
Sound,
Gain,
BiquadFilter,
DynamicsCompressor,
Delay,
Convolver,
EffectController,
} from 'notator';
import drums from './path/to/drums.mp3';
import arp from './path/to/arp.mp3';
import click from './path/to/click.mp3';
const timeline = new Timeline({
bpm: 65,
effects: [
new DynamicsCompressor({
threshold: -24,
knee: 30,
ratio: 12,
attack: .003,
release: .25,
}),
],
});
const part = new Part({
duration: 1, // duration in bars
effects: [
new Gain({
gain: .75,
}),
],
tracks: [
new Track({
duration: 1,
src: drums,
}),
new Track({
duration: 1,
src: arp,
effects: [
new Delay({
delayTime: .1,
}),
],
}),
],
});
An EffectController is used to dynamically control parameters or to sync multiple effects:
import {
Gain,
EffectController,
} from 'notator';
const gainA = new Gain();
const gainB = new Gain();
const ctrl = new EffectController({
effects: [
gainA,
gainB,
],
});
// parameters can now be dynamically changed
ctrl.set( 'gain', .5 );
This happens because the browsers' audio system is overloaded. Try reducing the amount of sounds being played simultaneously or the number of effects used. Complex effects like Convolvers are especially taxing. Firefox seems to have a problem with Convolvers in general, so use them with caution for now.
Do you, by any chance, have multiple tabs/windows of the same project open? Yeah, no worries. It happened to me as well.
notator is named after Notator SL, a MIDI sequencer for the Atari ST.
© 2020 DOWNPOUR DIGITAL, licensed under BSD-4-Clause
FAQs
Reactive/adaptive soundtracks for the web
We found that notator demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.