
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
A dead simple STT library in Node
Sonus lets you quickly and easally add a VUI (Voice User Interface) to any hardware or software project. Just like Alexa, Google Now, and Siri, Sonus is always listening offline for a customizable hotword. Once that hotword is detected your speech is streamed to the cloud recognition service of your choice - then you get the results.
npm install --save sonus
Generally, running npm install should suffice. This module however, requires you to install SoX.
Recommended: use arecord, which comes with most linux distros.
Alternatively:
sudo apt-get install sox libsox-fmt-all
brew install sox
Configure out cloud speech recognition system of choice, like Google Cloud Speech API.
Add sonus and said recognizer:
const Sonus = require('sonus')
const speech = require('@google-cloud/speech')({
projectId: 'streaming-speech-sample',
keyFilename: './keyfile.json'
})
Add your keyword and initialize Sonus with a Snowboy hotword:
const hotwords = [{ file: 'resources/snowboy.umdl', hotword: 'snowboy' }]
const sonus = Sonus.init({ hotwords }, speech)
Create your own Alexa in less than a tweet:
Sonus.start(sonus)
sonus.on('hotword', (index, keyword) => console.log("!"))
sonus.on('final-result', console.log)
This project uses semantic versioning as of v0.1.0
Follow these instructions.
Sonus uses Snowboy for offline hotword recognition. You can use their website or API to train a model for a new hotword. Hotword training must occur online through their web service.
If you've build a project with Sonus send a PR and include it here!
Evan Cohen: @_evnc
Ashish Chandwani: @ashishschandwa1
Licensed under MIT.
FAQs
Open source cross platform decentralized always-on speech recognition framework
The npm package sonus receives a total of 8 weekly downloads. As such, sonus popularity was classified as not popular.
We found that sonus demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.