
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Trampoline provides a node server that gives a RESTful API to AirPlay devices on the local network via node-airplay. The server can be used by applications on the local machine or network to discover AirPlay devices and control the playback of those devices with one API.
Eventually, Trampoline will provide transparent video serving (exposing individual local files over HTTP to enable playback from AirPlay devices) and transcoding (sourcing from local or remote video files and transcoding into a format that Apple devices will accept).
npm install trampoline
npm start trampoline
With npm:
npm install trampoline
From source:
cd ~
git clone https://benvanik@github.com/benvanik/trampoline.git
npm link trampoline/
When using npm start, use npm config to change the launch options:
npm config set trampoline:port 8090
npm start trampoline
If launching directly via trampoline:
trampoline --port=8090
NOTE: content status readyToPlay must be true before attempting playback!
Setup a new content serving request:
POST /content/setup
{
source: {
content: string,
mimeType: string, // 'video/webm'
cookie: string,
referer: string,
auth: string // user:password
},
target: {
mimeType: string, // 'video/mp4'
resolution: number, // 480, 720, 1080, undefined for original
quality: number // [0-1], undefined for don't care
}
}
--> {
id: string
}
GET /content/[id]
--> [streaming content]
PUT /content/[id]
DELETE /content/[id]
GET /content/[id]/status
--> {
cached: boolean,
seekable: boolean,
readyToPlay: boolean
}
POST /content/[id]/cache
{}
--> {}
List all devices on the network (query occasionally):
GET /device/list
--> {
devices: [
{
id: string,
name: string,
deviceId: string,
features: number,
model: string,
slideshowFeatures: [],
supportedContentTypes: [string, ...]
}, ...
]
}
Get the information of a specific device:
GET /device/id/
--> {
id: string,
name: string,
deviceId: string,
features: number,
model: string,
slideshowFeatures: [],
supportedContentTypes: [string, ...]
}
Get the playback status of a device:
GET /device/id/status
--> {
duration: number,
position: number,
rate: number,
playbackBufferEmpty: boolean,
playbackBufferFull: boolean,
playbackLikelyToKeepUp: boolean,
readyToPlay: boolean,
loadedTimeRanges: [
{
start: number,
duration: number
}, ...
],
seekableTimeRanges: [
{
start: number,
duration: number
}, ...
]
}
Begin playback of the given content:
POST /device/id/play
{
content: string,
start: number
}
--> {}
Stop playback of the current content:
POST /device/id/stop
{}
--> {}
Seek to the given position in the current content:
POST /device/id/scrub
{
position: number
}
--> {}
Change the playback rate of the current content (0 = pause, 1 = resume):
POST /device/id/rate
{
value: number
}
--> {}
Adjust the playback volume:
POST /device/id/volume
{
value: number
}
--> {}
TODO: Post a photo for slideshow mode:
POST /device/id/photo
{
content: string,
transition: string
}
--> {}
Transcoding: install mac ports sudo port install ffmpeg +nonfree sudo port install mplayer +nonfree HTTP Live Streaming Tools
TODO: repackage on git so can be handled by npm somehow wget http://sourceforge.net/projects/mediainfo/files/binary/mediainfo/0.7.50/MediaInfo_CLI_0.7.50_GNU_FromSource.tar.bz2/download tar zxvf MediaInfo_CLI_0.7.50_GNU_FromSource.tar.bz2 cd MediaInfo_CLI_0.7.50_GNU_FromSource/ ./CLI_Compile.sh cd MediaInfo/Project/GNU/CLI && make install
MENCODER=$(which mencoder) MEDIAINFO=$(which mediainfo) FFMPEG=$(which ffmpeg) LSDVD=$(which lsdvd) XML=$(which xmlstarlet)
/Applications/VLC.app/Contents/MacOS/VLC -vv SOURCEFILE --intf=rc '--sout=#transcode{vcodec=h264,vb=2048,acodec=mp4a,ab=192}:standard{mux=ts,dst=-,access=file}' | mediastreamsegmenter -f /some/tmp/path/ -D
FAQs
Apple AirPlay trampoline server
We found that trampoline demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.