
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A browser-first, content-addressed chunk store with a simple API and GC, designed to run without a build step and verified via Cypress E2E tests. The store is now OPFS-backed for persistence in modern browsers.
A browser-first, content-addressed chunk store with a simple API and GC, designed to run without a build step and verified via Cypress E2E tests. The store is now OPFS-backed for persistence in modern browsers.
See chunk-store-prd.md for the full PRD.
Prereqs: Node 18+ and pnpm.
pnpm i
pnpm dev # serves the demo at http://localhost:3000
# In another terminal
pnpm cy:open # interactive
# or
pnpm cy:run # headless
Open http://localhost:3000. The demo page lets you:
has(hash) and get(hash)getStats()The page imports the library directly:
<script type="module">
import { createChunkStore, enc, dec } from "../index.js";
// ...
</script>
The interface follows the PRD. The implementation is browser-native and OPFS-backed for persistence.
interface ChunkStore {
// Core operations
put(data: Uint8Array): Promise<string>; // returns sha256 hex
get(hash: string): Promise<Uint8Array | null>;
has(hash: string): Promise<boolean>;
// Garbage collection
beginGCCycle(): Promise<void>;
markReachable(hash: string): Promise<void>;
sweep(): Promise<void>;
// Management
close(): Promise<void>;
getStats(): Promise<StoreStats>;
}
interface StoreStats {
totalChunks: number;
totalSize: number;
segmentCount: number;
cacheHitRate: number;
}
interface ChunkStoreConfig {
name: string;
segmentSize?: number;
cacheSize?: number;
writeBufferSize?: number;
hashAlgorithm?: "sha256" | "blake3"; // currently only sha256 is implemented
}
// Factory
function createChunkStore(config?: ChunkStoreConfig): Promise<ChunkStore>;
import { createChunkStore, enc, dec } from "vunt";
const store = await createChunkStore({ name: "demo" });
const hash = await store.put(enc("hello vunt"));
console.log("hash:", hash); // 64-hex sha256
const data = await store.get(hash);
console.log("value:", data ? await dec(data) : null);
const ok = await store.has(hash);
console.log("has?", ok);
await store.beginGCCycle();
await store.markReachable(hash); // mark the chunk you want to keep
await store.sweep(); // unmarked chunks are removed
const stats = await store.getStats();
console.log(stats); // { totalChunks, totalSize, segmentCount, cacheHitRate }
await store.close();
src/index.js — public exports; OPFS-backed store under the PRD APIsrc/webapp/index.html — demo UI to explore APIsrc/webapp/server.js — ESM static dev server (http://localhost:3000)cypress/ — E2E tests; basic.cy.js runs the demo app flowchunk-store-prd.md — Product Requirements Documentdirectory.md — Repo map and developer guideThis library is authored in plain JavaScript and ships TypeScript type declarations only. No runtime build step is required.
dist/types/index.d.tssrc/index.js, types via package.json#types and exports mapUsage:
import {
createChunkStore,
enc,
dec,
type ChunkStore,
type ChunkStoreConfig,
} from "vunt";
const cfg: ChunkStoreConfig = { name: "demo" };
const store: ChunkStore = await createChunkStore(cfg);
put/get/has persistently — DONEhasISC
FAQs
A browser-first, content-addressed chunk store with a simple API and GC, designed to run without a build step and verified via Cypress E2E tests. The store is now OPFS-backed for persistence in modern browsers.
We found that vunt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.