
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
ZSTD (Zstandard) decoder for Web and Node.js, using WebAssembly.
npm install --save zstddec
import { ZSTDDecoder } from 'zstddec';
const decoder = new ZSTDDecoder();
await decoder.init();
const decompressedArray = decoder.decode( compressedArray, uncompressedSize );
Limitations: The decoder may fail with the error
wasm function signature contains illegal typewhen theuncompressedSizeis not known in advance and given to thedecode()method. This is presumably a bug in the WASM bindings, which I am not yet sure how to fix.
To build the project locally, run:
yarn install
yarn build
To test changes:
yarn test
Compiled from https://github.com/facebook/zstd/tree/dev/build/single_file_libs, with the following steps:
# build zstd
make
cd build/single_file_libs
./create_single_file_decoder.sh
# build wasm
emcc zstddeclib.c -s EXPORTED_FUNCTIONS="['_ZSTD_decompress', '_ZSTD_findDecompressedSize', '_ZSTD_isError', '_malloc', '_free']" -Wl,--no-entry -s WASM=1 -Oz -g0 -flto -s ALLOW_MEMORY_GROWTH=1 -s FILESYSTEM=0 -s STANDALONE_WASM=1 -DNDEBUG=1 -s PURE_WASI=0 -o zstddec.wasm
# build streaming wasm
emcc zstddeclib.c -s EXPORTED_FUNCTIONS="['_ZSTD_decompress', '_ZSTD_findDecompressedSize', '_ZSTD_createDCtx', '_ZSTD_decompressStream', '_ZSTD_freeDCtx', '_ZSTD_DStreamInSize', '_ZSTD_DStreamOutSize', '_malloc', '_free']" -Wl,--no-entry -s WASM=1 -Oz -g0 -flto -s ALLOW_MEMORY_GROWTH=1 -s FILESYSTEM=0 -s STANDALONE_WASM=1 -DNDEBUG=1 -s PURE_WASI=0 -o zstddec-stream.wasm
# encode WASM to base64
base64 -i zstddec.wasm > zstddec.txt
base64 -i zstddec-stream.wasm > zstddec-stream.txt
The base64 string written to zstddec.txt is embedded as the wasm variable at the bottom
of the source file. The rest of the file is written by hand, in order to avoid an additional JS
wrapper generated by Emscripten.
Last built June 2025, zstd v1.5.7 (f8745da6), emscc v4.0.10.
JavaScript wrapper is provided under the MIT License, and the WASM ZSTD decoder is provided by Facebook under the BSD 3-Clause License.
FAQs
ZSTD (Zstandard) decoder for Web and Node.js, using WebAssembly
The npm package zstddec receives a total of 506,281 weekly downloads. As such, zstddec popularity was classified as popular.
We found that zstddec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.