
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Png, Jpeg, Gif, Ico and SvgInstall the package from npm:
yarn add thumbo
import Thumbo, { Transfer } from "thumbo";
Thumbo.init().then(async () => {
Thumbo.thumbnail(
Transfer(await (await fetch("/path/to/img.png")).arrayBuffer()),
Thumbo.ImageFormat.Png,
20,
20
).then((thumbnailBuffer) => {
document.getElementById("img1").src = URL.createObjectURL(
new Blob([thumbnailBuffer])
);
});
Thumbo.thumbnailFromUrl(
"https://example.com/image.png",
Thumbo.ImageFormat.Png,
20,
20
).then((thumbnailBuffer) => {
document.getElementById("img2").src = URL.createObjectURL(
new Blob([thumbnailBuffer])
);
});
});
Initiates thumbo. The initiation proccess includes:
isInitialized field is set true.InitOptions interface provides the configuration for the init method.
interface InitOptions {
/** Url to fetch the thumbo-core WASM bundle. Defaults to the bundle hosted on unpkg. */
wasmUrl?: string;
/** Maximum no. of tasks to run on one worker thread at a time. Defaults to one. */
concurrency?: number;
/** Maximum no. of jobs to be queued for execution before throwing an error. */
maxQueuedJobs?: number;
/** Gives that pool a name to be used for debug logging, letting you distinguish between log output of different pools. */
name?: string;
/** No. of worker threads to spawn and to be managed by the pool. */
size?: number;
}
Mark transferable objects within an arbitrary object or array as being a transferable object. They will then not be serialized and deserialized on messaging with the main thread, but ownership of them will be tranferred to the receiving thread.
Only array buffers, message ports and few more special types of objects can be transferred, but it's much faster than serializing and deserializing them.
Returns a TransferDescriptor, a container that holds the arraybuffer to be transferred.
Note: The transferable object cannot be accessed by this thread again unless the receiving thread transfers it back again!
Transferable: transferable Array buffer, message port or similar.
See https://developers.google.com/web/updates/2011/12/Transferable-Objects-Lightning-Fast
Enums of supported image formats. Thumbo supports thumbnail creation for the following formats:
Creates a thumbnail from the provided arraybuffer transfer descriptor. The provided arraybuffer is transferred to the worker for processing, once the task is completed, the newly created thumbnail arraybuffer is transferred back to the main thread.
Creates a thumbnail from the provided Url. Once the task is completed, the created thumbnail arraybuffer is transferred to the main thread.
Returns the workers in the pool
Note: Accessing this property before thumbo is initialized will throw an error.
Returns a promise that resolves once the task queue is emptied. Promise will be rejected if any task fails.
allowResolvingImmediately Set to true to resolve immediately if task queue is currently empty.
Returns a promise that resolves once the task queue is emptied. Failing tasks will not cause the promise to be rejected.
allowResolvingImmediately Set to true to resolve immediately if task queue is currently empty.
Note: Calling this function before thumbo is initialized will throw an error.
Returns a promise that resolves once the task queue is emptied. Failing tasks will not cause the promise to be rejected.
force Set to true to kill the thread even if it cannot be stopped gracefully.
Note: Calling this function before thumbo is initialized will throw an error.
FAQs
Dead fast thumbnail library for browser and NodeJs
The npm package thumbo receives a total of 27 weekly downloads. As such, thumbo popularity was classified as not popular.
We found that thumbo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.