Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
vmsg is a small library for creating voice messages. While traditional way of communicating on the web is via text, sometimes it's easier or rather funnier to express your thoughts just by saying it. Of course it doesn't require any special support: record your voice with some standard program, upload to file hosting and share the link. But why bother with all of that tedious stuff if you can do the same in browser with a few clicks.
:confetti_ball: :tada: DEMO :tada: :confetti_ball:
npm install vmsg --save
import { record } from "vmsg";
someButton.onclick = function() {
record(/* {wasmURL: "/static/js/vmsg.wasm"} */).then(blob => {
console.log("Recorded MP3", blob);
// Can be used like this:
//
// const form = new FormData();
// form.append("file[]", blob, "record.mp3");
// fetch("/upload.php", {
// credentials: "include",
// method: "POST",
// body: form,
// }).then(resp => {
// });
});
};
That's it! Don't forget to include vmsg.css and vmsg.wasm in your project. For browsers without WebAssembly support you need to also include wasm-polyfill.js.
See demo directory for a more feasible example.
A minimal React example for using Recorder with your own UI can be found here.
See also non React demo and Recording mp3 audio in HTML5 using vmsg article.
LLVM_ROOT
variable of Emscripten config.git clone --recurse-submodules https://github.com/Kagami/vmsg.git && cd vmsg
make clean all
npm install
npm start
These instructions are very basic because there're a lot of systems with different conventions. Docker image would probably be provided to fix it.
vmsg uses LAME encoder underneath compiled with Emscripten to WebAssembly module. LAME build is optimized for size, weights only little more than 70kb gzipped and can be super-efficiently fetched and parsed by browser. It's like a small image.
Access to microphone is implemented with Web Audio API, data samples sent to Web Worker which is responsibe for loading WebAssembly module and calling LAME API.
Module is produced with modern LLVM WASM backend and LLD linker which
should become standard soon, also vmsg has own tiny WASM runtime instead
of Emscripten's to decrease overall size and simplify architecture.
Worker code is included in the main JS module so end-user has to care
only about 3 files: vmsg.js
, vmsg.css
and vmsg.wasm
. CSS can be
inlined too but IMO that would be ugly.
In order to support browsers without WebAssembly, WebAssembly polyfill is being used. It translates binary module into semantically-equivalent JavaScript on the fly (almost asm.js compatible but doesn't fully validate yet) so we don't need separate asm.js build and can use standard WebAssembly API. It's not as effecient but for audio encoding should be enough.
See also: Creating WebAssembly-powered library for modern web article.
MediaStream Recording API is great but:
vmsg is licensed under CC0.
LAME is licensed under LGPL.
MP3 patents seems to have expired since April 23, 2017.
FAQs
Library for creating voice messages
We found that vmsg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.