
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
readable-blob-stream
Advanced tools
Read W3C Blob & File objects as a Node stream. Very useful with "browserify" and "primus" with "ejson" using pipe()
Read W3C Blob & File objects as a Node stream. Very useful with "browserify" and "primus" with "ejson" using pipe().
If you are already generating a bundle using browserify (or something similar), you can use it directly:
npm install readable-blob-stream --save
var ReadableBlobStream = require('readable-blob-stream');
Or, you can generate a standalone javascript file by cloning or downloading this repo and typing:
npm install
npm run bundle
Look in the build directory to find the generated file. This is a
UMD module.
Which means you can either require() it using browserify, load it using AMD, or access it as the global window.ReadableBlobStream
<!DOCTYPE html>
<html>
<head>
<title>test</title>
<script src="readable-blob-stream.js"></script>
<script>
window.addEventListener('DOMContentLoaded', function()
{
var myfile = document.getElementById('myfile');
myfile.addEventListener('change', function()
{
var file = myfile.files[0];
if (!file) { return; }
var stream = new ReadableBlobStream(file);
// or:
//var stream = new ReadableBlobStream(file, {highWaterMark : 128, encoding: 'utf8'});
stream.on('error', function(err)
{
console.log('error while reading your file:', err);
});
stream.on('end', function()
{
console.log('there will be no more data.');
});
stream.on('data', function(data)
{
// if you do not set an encoding,
// "data" is both a Buffer and an Uint8Array
console.log('got %d amount of data: ', data.length, data);
});
// If you are using primus you can simply use:
// stream.pipe(spark);
// instead of using the 'data' listener
});
});
</script>
</head>
<body>
<p>hi!</p>
<input type="file" id="myfile">
</body>
</html>
FAQs
Read W3C Blob & File objects as a Node stream. Very useful with "browserify" and "primus" with "ejson" using pipe()
The npm package readable-blob-stream receives a total of 253 weekly downloads. As such, readable-blob-stream popularity was classified as not popular.
We found that readable-blob-stream demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.