
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
Image color palette extraction with node-canvas for node.js

$ npm install palette
Note: Palette's dependency, node-canvas, requires that Cairo be installed. Please see the installation guide for node-canvas for further details.
Palette's public API consists of a single function, the one returned by require(). This function accepts the canvas you wish to compute a color palette for, and an optional number of samples defaulting to 5.
The following example is taken from the ./test script, showing you how you may re-draw the palette onto the original canvas, however it is of course possible to save these values in a database etc.
var colors = palette(canvas, 10);
colors.forEach(function(color){
var r = color[0]
, g = color[1]
, b = color[2]
, val = r << 16 | g << 8 | b
, str = '#' + val.toString(16);
ctx.fillStyle = str;
ctx.fillRect(x += 31, canvas.height - 40, 30, 30);
});
$ ./test examples/cat.jpg && open /tmp/out.png
This is the contents of ./test. The means of loading the image data and drawing it to the Canvas is up to you, they could be from a database, the file system, fetched from the web, however here we simply use img.src = path.
#!/usr/bin/env node
var palette = require('./')
, fs = require('fs')
, Canvas = require('canvas')
, Image = Canvas.Image
, canvas = new Canvas
, ctx = canvas.getContext('2d')
, path = process.argv[2]
, out = '/tmp/out.png';
if (!path) {
console.error('Usage: test <image>');
process.exit(1);
}
var img = new Image;
img.onload = function(){
canvas.width = img.width;
canvas.height = img.height + 50;
ctx.fillStyle = 'white';
ctx.fillRect(0, 0, canvas.width, canvas.height);
ctx.drawImage(img, 0, 0);
paintPalette();
save();
};
img.src = path;
function paintPalette() {
var x = 0;
var colors = palette(canvas);
colors.forEach(function(color){
var r = color[0]
, g = color[1]
, b = color[2]
, val = r << 16 | g << 8 | b
, str = '#' + val.toString(16);
ctx.fillStyle = str;
ctx.fillRect(x += 31, canvas.height - 40, 30, 30);
});
}
function save() {
fs.writeFile(out, canvas.toBuffer(), function(err){
if (err) throw err;
console.log('saved %s', out);
});
}

(The MIT License)
Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Image color palette with node-canvas
The npm package palette receives a total of 7 weekly downloads. As such, palette popularity was classified as not popular.
We found that palette demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.