
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
speaker-calibration
Advanced tools
Speaker-Calibration provides a simple API for performing speaker calibration in Javascript. The Library has minimal dependencies and is designed to be used in the browser.
<!-- index.html --->
...
<body>
...
<script src="https://unpkg.com/speaker-calibration@1.4.1/dist/main.js"></script>
</body>
// speaker.js
// initialize the chosen calibrator with the paramters, or pass no paramters to use default settings
const calibrator = new ImpulseResponseCalibration({
numCaptures: 3,
numMLSPerCapture: 3,
download: false,
});
// pass the calibrator and speaker paramters to the startCalibration method (async)
const invertedIR = await Speaker.startCalibration(
{
siteUrl: window.location.href.substring(0, location.href.lastIndexOf('/')),
targetElementId: 'display',
},
calibrator
);
// listener.js
window.listener = new speakerCalibrator.Listener({
targetElementId: 'display',
});


As of 07/29/2022
git clone https://github.com/EasyEyes/speaker-calibration.gitcd speaker-calibrationnpm iAll outputs from the scripts/recipies below should be automatically placed in the /dist directory.
This is what will be served once the library is published.
In /dist/example you will find a small example app that uses the speaker-calibration library.
In package.json you will see some key scripts:
build:prod tells webpack to build the library in production mode, outputing to /distbuild:dev tells webpack to build the library in development watch mode, outputing to /distbuild:dev:analyze tells webpack to build the library in development mode and open up a bundle
analysis page. Helpful for viewing the size of the library, broken down by individual modules
and/or dependencies.serve:dev spins up an express.js server on port 3000 using nodemon. It serves the
/dist & /dist/example folders.build:wasm calls the makefile recipe to clean, and rebuild the web assembly code (requires
emscripten installed, more details below)lint runs eslint on all js files in the projectlint:fix lints and automatically fixes all js files in the project.build:doc builds the documentation using jsdoc. Outputs to /docRun (2) & (3) in seperate shell windows, with this setup you will be able to modify both the
library and front end examples with hot reload built in. Run (7) precommit to keep you code
standardized.
We are using Emscripten to compile the C++ code into a wasm file. Usage
requires the installation of the Emscriten compiler. Instructions can be found on their website. In
makefile you will see a few recipies:
mlsGen_bind compiles the cpp files to wasm, generating a modularized javascript "glue" file,
using embind. This is the current build targetmlsGen_module compiles the cpp files to wasm, generating a modularized javascript "glue" file.mlsGen_wasm compiles the cpp file to a stand-alone wasm without a javascript "clue" file.clean cleans up and generated coderebuild cleans and rebuilds the output. Run this after making changes to the cpp files.We use jsdoc standards to document our library.
We use ESLint to lint our code and enforce best practices. We are currently using AirBnB's JavaScript Style Guide
We use Prettier to format our code.
main will automatically trigger a deploy on the netlify project. This
deployment is only relevant to the example app, it will not make any changes to any others using
the library.speaker-calibration is library that is published to npm. This means
that in order to make your changes 'live' a new version of the library needs to be published.
Conveniently, there exists an npm package np which provides a
lot of helpful abstractions and UI elements when dealing with npm.FAQs
Speaker calibration library for auditory testing
The npm package speaker-calibration receives a total of 725 weekly downloads. As such, speaker-calibration popularity was classified as not popular.
We found that speaker-calibration demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.