
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
srcfull is a package-first toolkit for extracting and upgrading web image URLs.
It is designed as a standalone library and CLI for image extraction and source resolution. The focus is:
It handles the page-shape problems that usually make this kind of package annoying in practice:
data-src, data-srcset, and data-originalimg srcset, picture source, inline background images, and social/meta image tagsHEAD fallback to ranged GET for hosts that refuse metadata requestspnpm install
pnpm build
import { scrapePage, resolveImageUrl } from "srcfull";
const resolved = await resolveImageUrl(
"https://cdn.example.com/image.jpg?w=400&q=80"
);
const page = await scrapePage("https://example.com/product-page");
scrapePage() normalizes relative candidates against the page URL before validation and resolution, so typical product/article HTML works without extra preprocessing.
If you need rendered HTML instead of plain fetch, inject a custom fetcher:
import { scrapePage } from "srcfull";
import { createScrapingBeeHtmlFetcher } from "srcfull/providers/scrapingbee";
const fetchHtml = createScrapingBeeHtmlFetcher({
apiKey: process.env.SCRAPINGBEE_API_KEY!,
});
const result = await scrapePage("https://example.com", { fetchHtml });
If you want the built-in fetcher with different timeout or header behavior:
import { createDefaultHtmlFetcher, scrapePage } from "srcfull";
const fetchHtml = createDefaultHtmlFetcher({
timeoutMs: 15_000,
headers: {
"Accept-Language": "en-GB,en;q=0.9",
},
});
const result = await scrapePage("https://example.com", { fetchHtml });
For image-only fallback:
import { createFirecrawlImageFallback } from "srcfull/providers/firecrawl";
If you want candidate extraction without the rest of the pipeline:
import { extractImageCandidatesFromHtml } from "srcfull";
const candidates = extractImageCandidatesFromHtml(
html,
"https://example.com/product-page"
);
For repeat jobs, persist cache and learned patterns on disk:
import {
createFileCache,
createFilePatternStore,
resolveImageUrl,
} from "srcfull";
const cache = createFileCache({ filePath: ".srcfull/cache.json" });
const patternStore = createFilePatternStore({
filePath: ".srcfull/patterns.json",
});
const result = await resolveImageUrl("https://cdn.example.com/photo.jpg?w=400", {
cache,
patternStore,
});
srcfull resolve 'https://cdn.example.com/photo.jpg?w=300'
srcfull scrape 'https://example.com/listing' --max-images=12
srcfull scrape 'https://example.com/listing' --max-images=12 --min-size=300 --resolve-concurrency=8
srcfull --version
The JSON response from scrape includes stats.returned as well as found, resolved, failed, and durationMs.
There is a self-contained demo page at docs/demo/index.html.
pnpm demo:build
pnpm demo:serve
The page is generated from real calls to the package, so the HTML samples, extracted candidates, resolved URLs, and persisted cache/pattern snapshots are actual outputs rather than hand-written mockups.
pnpm test
pnpm test:live-patterns
pnpm typecheck
pnpm build
pnpm test:live-patterns revalidates the researched real-world CDN fixtures in test/fixtures/curated-patterns.json against the network.
FAQs
Image extraction and source-resolution toolkit for high-quality web images.
The npm package srcfull receives a total of 0 weekly downloads. As such, srcfull popularity was classified as not popular.
We found that srcfull demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.