Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Pitch is a Ruby gem that provides a way to generate audio tones, writes them to files, and detects those tones. It can be used in applications that need to test whether audio data is being written properly. For example, it is used in the HD24Dig gem to build a test harness for testing audio extraction from a multitrack digital recorder.
Pitches can be created from scientific pitch notation (SPN), where 'C4' is designated to be middle C. Or from MIDI notation where either the string 'C3' or the value 60 is middle C. Pitches can be converted between various forms, as well as added to or subtracted from. Finally, pitches can be written to files as audio tones, and generated by analyzing files with audio tones.
require 'pitch'
# make a pitch of C4 (SPN)
pitch = Pitch.new_from_spn('C4')
# make a file containing a tone with the pitch
pitch.write_to_file('tone.wav', rate: 48000, depth: 24)
# read the file to determine the pitch
pitch = Pitch.read_from_file('tone.wav')
Install as a gem:
gem install pitch
...or add to your Gemfile
or .gemspec
file as needed.
This gem was written to use Ruby 3.3. It should work with versions of Ruby that are close to that.
Under the hood, Pitch uses SoX to generate tones and write audio files, and Aubio to analyze and detect tones from those files. You will need to install the appropriate package in order for the write_to_file
and read_from_file
methods to work properly. On macOS using Homebrew, that looks like this:
brew install sox
brew install aubio
FAQs
Unknown package
We found that pitch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.