
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
saxi is a tool for interacting with the AxiDraw drawing machine by Evil Mad Scientist. It comes with an easy-to-use interface, and is exactingly precise.

$ curl -sL https://deb.nodesource.com/setup_20.x | sudo -E bash -
$ sudo apt-get install -y nodejs
saxi globally:$ sudo npm install -g saxi
If you encounter an EACCES error when installing the package globally, see Resolving EACCES permissions errors when installing packages globally.
The official Node.js builds don’t support armv6l. Use an unofficial build:
$ wget https://unofficial-builds.nodejs.org/download/release/v20.5.1/node-v20.5.1-linux-armv6l.tar.xz
$ tar xf node-v*-armv6l.tar.xz
$ export PATH=$PATH:$PWD/node-v*-linux-armv6l/
saxi:$ npm install -g saxi
If you encounter an EACCES error when installing the package globally, see Resolving EACCES permissions errors when installing packages globally.
Start the saxi server from the terminal:
$ saxi
Server listening on http://0.0.0.0:9080
Connecting to EBB on /dev/tty.usbmodem1461
Then open a web browser:
Go to http://localhost:9080 if you're using the same computer where saxi is running.
Go to http://<computer-ip>:9080 if you're on a different device.
(You can find the IP address by running hostname -I on the computer running saxi.)
saxi over SSHIf you're connecting to your Raspberry Pi via SSH, it’s a good idea to keep the saxi server running inside a tmux session so it stays active even if your SSH session disconnects.
tmux (if not installed)$ sudo apt-get install -y tmux
tmux session and run saxi$ tmux new -s saxi
$ saxi
To detach from the session (leaving it running), press:
Ctrl + b, then d
To reattach later:
$ tmux attach -t saxi
To list sessions:
$ tmux ls
To terminate session:
$ tmux kill-session -t saxi
If you want to connect to saxi from a web page that isn't served by saxi
itself, you'll need to enable
CORS, otherwise
GET/POST requests will be denied by the browser. CORS is disabled by default as
a security precaution, but if you need it it's available. Just launch saxi with
the --enable-cors flag.
saxi makes use of the low-level LM command introduced in EBB firmware version
2.5.3 to carry out highly accurate constant-acceleration motion plans. If your
AxiDraw is running an older version of the firmware, saxi will fall back to the
less-accurate (but still pretty accurate) XM command.
To check what version of the EBB firmware your AxiDraw is running, run saxi --firmware-version:
$ saxi --firmware-version
EBBv13_and_above EB Firmware Version 2.5.3
To upgrade your AxiDraw's firmware, see here.
To work on saxi, you can clone this repo and then run npm start:
$ git clone https://github.com/alexrudd2/saxi
$ cd saxi
$ npm run start
This will not watch local files for changes. If you change the server code, you'll need to restart manually.
saxi's motion planning algorithm is heavily inspired by Michael Fogleman's axi project.
saxi's UI would be an ugly mess if it weren't for @kylestetz's discerning eye.
Thanks to Evil Mad Scientist for designing and building such a lovely machine!
These images were plotted by folks using saxi. If you'd like to add something you've made here, shoot me an email!
by Julien Terraz (@targz) |
by Antoine Beyeler (@abey79) |
by Lionel Radisson (@MAKIO135) |
by Daniel Feles (@daniel_feles) |
Use the SVG IO integration to generate images with AI using a text prompt. Enable it by passing the --svgio-api-key
paremeter when running on the server:
npm run build
node cli.mjs --svgio-api-key <THE API KEY>
FAQs
Drive the AxiDraw pen plotter
The npm package saxi receives a total of 17 weekly downloads. As such, saxi popularity was classified as not popular.
We found that saxi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.