
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Universal image CDN URL translator
There are many image CDNs that provide a URL API for transforming images. There is little consistency in these APIs, and it's often unclear what the API is for a given URL. This library aims to provide a consistent interface for detecting image CDN URLs and transforming them.
If you'd like to use this on the web, you might want to try Unpic img, a multi-framework image component, powered by Unpic.
It designed to work with image URLs from sources such as CMSs and other user-generated content, where the source image may or may not be from an image CDN, and may already have transforms applied. This allow different transforms to be applied for display on a website. A web framework may need to transform an image for display on a site. Rather than doing this by downloading and resizing it locally or re-processing it with a separate image service, this library can be used to transform the URL to use the original image CDN, which will then transform the image on the fly.
This library is available via URL imports for Deno and via npm for Node. To use it in Deno, import the module from deno.land:
import { transformUrl } from "https://deno.land/x/unpic/mod.ts";
To use it in Node, install it from npm:
npm install unpic
Then import it in your code:
import { transformUrl } from "unpic";
You can then use the transformUrl
function to transform a URL:
const url = transformUrl(
{
url:
"https://cdn.shopify.com/static/sample-images/bath_grande_crop_center.jpeg",
width: 800,
height: 600,
},
);
console.log(url.toString());
// https://cdn.shopify.com/static/sample-images/bath.jpeg?width=800&height=600&crop=center
You can also use the parseUrl
function to parse a URL and get the CDN and any
params:
const parsedUrl = parseUrl(
"https://cdn.shopify.com/static/sample-images/bath_800x600_crop_center.jpeg",
);
console.log(parsedUrl);
// {
// cdn: "shopify",
// width: 800,
// height: 600,
// base: "https://cdn.shopify.com/static/sample-images/bath.jpeg",
// params: {
// crop: "center",
// },
// }
You can bypass auto-detection by specifying the CDN:
const url = transformUrl(
{
url:
"https://cdn.shopify.com/static/sample-images/bath_grande_crop_center.jpeg",
width: 800,
height: 600,
cdn: "shopify",
},
);
This is particularly useful if you are using the CDN with a custom domain which is not auto-detected.
Unpic has special handling for Next.js image URLs. It detects supported image
CDNs, and falls back to /_next/image
for local and unsupported remote images.
For more information, see the Unpic Next.js documentation.
transformUrl
and parseUrl
.transformUrl
, the library will remove any format set in the
source image, changing it to auto-format. In most cases, this is what you
want. Almost all browsers now support modern formats such as WebP, and setting
auto-format will allow the CDN to serve the best format for the browser. If
you want to force a specific format, you can set it in transformUrl
.transformUrl
, it will return undefined
, as it will for any
URL that is not recognised as an image CDN URL. It is up to you to handle this
case.To add new domains or subdomains to an existing CDN, add them to domains.json
or subdomains.json
respectively.
To add a new CDN, add the following:
src/transformers
. This should export a transform
function that implements the UrlTransformer
interface, a parse
function
that implements the UrlParser
interface and optionally a generate
function
that implements the UrlGenerator
interface.src/transformers
. This should test all of the exported
API functions.domains.json
, subdomains.json
or paths.json
to
detect the CDNsrc/types.ts
, and import the new source file
in src/transform.ts
examples.json
in the demo sitedeno test src
FAQs
Universal image CDN translator
The npm package unpic receives a total of 38,992 weekly downloads. As such, unpic popularity was classified as popular.
We found that unpic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.