
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
A deterministic, no-magic Python toolkit for hiding messages in media. Built with hyperfixation.
A deterministic, no-magic Python toolkit for hiding messages in media.
Built during a hyperfixation spiral that got wildly out of hand — and I'm not even sorry.
Clean enough for clarity. Fast enough for scale.
__
/ _)
_.----._/ /
/ /
__| (|_|_|_|
`--' `-'-'
Because if you’re hiding data like a stealth dino,
you deserve a dino.
I haven’t slept in 72 hours and I know where every bit is.
stegopy is a zero-bloat, bit-accurate steganography library for embedding UTF-8 messages in images and audio. It was built with obsessive attention to structure, correctness, and minimalism.
No unnecessary abstractions. No guesswork.
Every bit has a reason to be where it is.
This library exists because I wanted:
It is not built for configurability. It’s built for peace of mind — the kind that comes from predictable behavior and clean code.
🖼️ Image Steganography
🔊 Audio Steganography
🔤 Full UTF-8 compatibility (multi-byte safe, emoji-friendly)
🧪 40+ unit tests — full coverage with low execution time
📚 Every function includes docstrings, error handling, and input checks
🧱 No dependencies (except Pillow)
⚡ Fast enough for high-volume batch stego with zero overhead
🦖 CLI with ASCII dinosaurs? You better believe it.
⚠️ Not for people who ask “but why doesn’t it do JPEG?”
Because sometimes, you want to know exactly what’s happening under the hood.
This library is built for minds that crave:
It's not “magical.”
It’s deliberate.
It’s not “easy.”
It’s exact.
pip install stegopy
(or install from source if you're a dev:)
git clone https://github.com/viodoescyber/stegopy
cd stegopy
pip install .
from stegopy.image import lsb
lsb.encode("cat.png", "cat_out.png", "hyperfixation? what hyperfixation?")
print(lsb.decode("cat_out.png"))
Use a specific color channel:
from stegopy.image import color
color.encode("input.png", "out.png", "Green is mathematically optimal.", channel="g")
Maybe hide in the alpha channel?
from stegopy.image import alpha
alpha.encode("alpha.png", "out.png", "This is invisible but the data is STILL PERFECTLY STRUCTURED")
Use only the center pixels (or corners!):
from stegopy.image import region
region.encode("map.png", "out.png", "Just top left. That's all I need.", region="topleft")
Or combine it all:
from stegopy.image import combo
combo.encode("canvas.png", "output.png", "Combo activated 💥", channel="b", region="center")
Yes, this works with any mix: region + alpha, channel + region, just alpha, or none at all. It Just Works™.
from stegopy.audio import lsb
lsb.encode("input.wav", "stego.wav", "I encoded this while pacing around my room for 2 hours straight")
print(lsb.decode("stego.wav"))
⚠️ Only accepts 16-bit mono PCM WAV and AIFF files — this is intentional.
Once installed, just run:
stegopy [message] <-e/--encode | -d/--decode> <-i input> [-o output] [--channel r/g/b] [--alpha]
Capacity estimation:
stegopy -i input.png -c
# 🧠 Estimated capacity: 1024 UTF-8 characters
Encode a message into an image:
stegopy "i belong in the LSB" -e -i cat.png -o secret.png
Decode from the same image:
stegopy -d -i output.png
Hide it in a specific channel:
stegopy "color-coded secrets" -e -i input.png -o out.png --channel g
Encode in the alpha layer:
stegopy "ghost text" -e -i transparent.png -o result.png --alpha
Combine with region targeting:
stegopy "top left green channel go brr" -e -i input.png -o out.png --channel g --region topleft
Embed an image into another image:
stegopy payload.png -e -i carrier.png -o out.png
Decode and auto-save if its an image:
stegopy -d -i out.png -o carrier.png
For audio:
stegopy "auditory hyperfixation" -e -i input.wav -o result.wav
stegopy -d -i result.wav
stegopy payload.png -e -i carrier.wav -o out.wav
stegopy -d -i out.wav -o carrier.png
❗ Only 16-bit PCM mono WAVs and AIFFs allowed. If you're here trying to LSB a .flac
, I’m going to assume you're from the future.
FAQs
A deterministic, no-magic Python toolkit for hiding messages in media. Built with hyperfixation.
We found that stegopy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.