
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
vipfs-protocol
Advanced tools
A robust TypeScript library for fragmenting, encrypting and uploading large video files to IPFS, using Ethereum-derived keys for security. Generates a JSON index to ensure video can be safely reassembled and decrypted later.
VIPFS Protocol is a TypeScript library for splitting large video files into fragments, encrypting each fragment with Ethereum-derived keys, uploading encrypted fragments to IPFS, and persisting the resulting metadata as a JSON index.
It is designed for workflows where large media assets need deterministic encryption, content-addressed storage, and a portable manifest that can be used later to recover fragment order and status.
npm install vipfs-protocol
or
yarn add vipfs-protocol
import {
EthereumWallet,
FragmentEncryptor,
IndexManager,
IPFSUploader,
VideoFragmenter,
} from 'vipfs-protocol'
const wallet = new EthereumWallet(process.env.VIPFS_MNEMONIC as string)
const fragmenter = new VideoFragmenter(5 * 1024 * 1024)
const encryptor = new FragmentEncryptor(wallet)
const uploader = new IPFSUploader('http://localhost:5001/api/v0')
const indexManager = new IndexManager()
const sourceVideoPath = './public/sample_1280x720.mp4'
const fragments = []
let index = 0
for await (const chunk of fragmenter.fragment(sourceVideoPath)) {
const encryptedChunk = await encryptor.encrypt(chunk, index)
const cid = await uploader.upload(encryptedChunk)
fragments.push({
index,
cid,
timestamp: Date.now(),
status: 'ok',
})
index += 1
}
const manifest = indexManager.createIndex('sample-video', fragments)
indexManager.saveToFile('./sample-video.index.json', manifest)
The current public API exports five services:
VideoFragmenterFragmentEncryptorEthereumWalletIPFSUploaderIndexManagerVideoFragmenter: reads a local file as stream-safe chunks.FragmentEncryptor: encrypts and decrypts each fragment buffer.EthereumWallet: derives deterministic 32-byte keys from a mnemonic.IPFSUploader: uploads encrypted fragments and downloads them by CID.IndexManager: creates, updates, saves, and loads the index JSON manifest.These services are exposed as composable primitives rather than a single orchestration manager.
Recommended runtime: Node.js 22. Recommended package manager: Yarn 1.22.22.
Setup:
yarn
Watch TypeScript builds:
yarn dev
Run the project quality pipeline:
yarn ci:local
| Script | Description |
|---|---|
build | Compile the library with TypeScript. |
dev | Run TypeScript in watch mode. |
test | Run Jest with coverage and JUnit output. |
lint | Run ESLint against src/ and __tests__/. |
lint:fix | Apply ESLint fixes. |
format | Format src/ and __tests__/ with Prettier. |
clean | Remove build, coverage, lockfile, and dependency artifacts. |
ci:local | Execute the local all-in-one quality pipeline: clean, install, lint, format, test, build, and pack. |
Read CONTRIBUTING.md before opening a pull request. The repository also includes GitHub issue templates, a pull request template, and Copilot collaboration guidance under .github/.
Read SECURITY.md for responsible disclosure guidance.
For questions, feedback, or business inquiries:
✉️ Email: netzuleando@gmail.com
🌐 Website: Github
Made with ❤️ by the @Netzulo
FAQs
A robust TypeScript library for fragmenting, encrypting and uploading large video files to IPFS, using Ethereum-derived keys for security. Generates a JSON index to ensure video can be safely reassembled and decrypted later.
We found that vipfs-protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.