
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
zlib port to javascript, very fast!
Why pako is cool:
This project was done to understand how fast JS can be and is it necessary to develop native C modules for CPU-intensive tasks. Enjoy the result!
Benchmarks:
node v24, 1mb input sample:
deflate-pako x 14.27 ops/sec ±3.41% (37 runs sampled)
deflate-pako-zlib-hash x 10.60 ops/sec ±0.50% (29 runs sampled)
deflate-zlib x 30.30 ops/sec ±0.61% (51 runs sampled)
gzip-pako x 13.48 ops/sec ±0.50% (36 runs sampled)
inflate-pako x 138 ops/sec ±1.26% (75 runs sampled)
inflate-zlib x 397 ops/sec ±1.37% (81 runs sampled)
ungzip-pako x 125 ops/sec ±1.46% (73 runs sampled)
zlib's test is partially affected by marshalling (that make sense for inflate only). You can change deflate level to 0 in benchmark source, to investigate details. For deflate level 6 results can be considered as correct.
Install:
npm install pako
Full docs - http://nodeca.github.io/pako/
const pako = require('pako');
// Deflate
//
const input = new Uint8Array();
//... fill input data here
const output = pako.deflate(input);
// Inflate (simple wrapper can throw exception on broken stream)
//
const compressed = new Uint8Array();
//... fill data to uncompress here
try {
const result = pako.inflate(compressed);
// ... continue processing
} catch (err) {
console.log(err);
}
//
// Alternate interface for chunking & without exceptions
//
const deflator = new pako.Deflate();
deflator.push(chunk1, false);
deflator.push(chunk2); // second param is false by default.
...
deflator.push(chunk_last, true); // `true` says this chunk is last
if (deflator.err) {
console.log(deflator.msg);
}
const output = deflator.result;
const inflator = new pako.Inflate();
inflator.push(chunk1);
inflator.push(chunk2);
...
inflator.push(chunk_last); // no second param because end is auto-detected
if (inflator.err) {
console.log(inflator.msg);
}
const output = inflator.result;
Sometime you can wish to work with strings. For example, to send stringified objects to server. Pako's deflate detects input data type, and automatically recode strings to utf-8 prior to compress. Inflate has special option, to say compressed data has utf-8 encoding and should be recoded to javascript's utf-16.
const pako = require('pako');
const test = { my: 'super', puper: [456, 567], awesome: 'pako' };
const compressed = pako.deflate(JSON.stringify(test));
const restored = JSON.parse(pako.inflate(compressed, { to: 'string' }));
Pako does not contain some specific zlib functions:
deflateCopy, deflateBound, deflateParams,
deflatePending, deflatePrime, deflateTune.inflateCopy, inflateMark,
inflatePrime, inflateGetDictionary, inflateSync, inflateSyncPoint, inflateUndermine.Personal thanks to:
Original implementation (in C):
/lib/zlib folder/lib/zlib contentThe zlib package is a core module in Node.js for compression/decompression. It is similar to pako but is built into Node.js and does not work in the browser without additional bundling or shimming.
JSZip is a library for creating, reading, and editing .zip files with JavaScript, with a lovely and simple API. While pako focuses on zlib compression, JSZip provides additional functionalities to handle zip files.
Compressjs is a pure JavaScript implementation of various data compression algorithms, such as Huffman coding and Burrows-Wheeler transform. It offers a wider range of algorithms than pako, but it might not be as optimized for speed.
fflate is a high-performance, low-level deflate/inflate compression library that is faster than pako on most benchmarks. It is a newer library that focuses on performance and efficiency.
FAQs
zlib port to javascript - fast, modularized, with browser support
The npm package pako receives a total of 83,686,261 weekly downloads. As such, pako popularity was classified as popular.
We found that pako demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.