install

Additional install commands

macOS

Homebrewverified · 100%

brew install imagejs

local Homebrew formula metadata

overview

Package summary

Tool to hide JavaScript inside valid image files

Project links

Commands and aliases

imagejs

history

Project history and usage

imagejs is a small proof-of-concept command-line tool for packaging JavaScript into files that remain valid image files. The README presents it as a way to create image files that can execute JavaScript and explicitly connects the idea to extending XSS vulnerabilities.

Project history

The project appeared on GitHub in 2014 and credits Ajin Abraham's work on GIFs serving JavaScript as the idea that inspired the C implementation. The README says imagejs added bitmap support, and the changelog shows later support for GIF injection, BMP injection, WebP injection, and additional output formats.

Adoption history

imagejs remained a niche security package rather than a broad media utility. GitHub repository metadata shows far more stars than package-manager breadth, and the input metadata lists Homebrew as the only package-manager mapping for this batch.

How it is used

Users run imagejs with an output type and a JavaScript file, producing an image-like file named after the input. The README documents BMP, GIF, WebP, PNM, and PGF outputs, a line-viewable BMP mode, and injection into existing GIF files.

Why package nerds care

The package is interesting because it lives at the boundary between file-format polyglots and web security demonstrations. It is not a general steganography suite; it is a compact package for showing how MIME assumptions, image upload policies, and script execution contexts can collide.

Timeline

2014: GitHub repository is created.
0.4.1: GIF, BMP, WebP, PNM, and PGF output support is documented in the changelog.
0.5.0: GIF injection support is added.
0.6.0: BMP injection support is added.
0.7.0: WebP injection support is added.

Related projects

The README names Ajin Abraham's GIF/JavaScript work as the source idea. Conceptually, imagejs is related to polyglot-file demos, browser XSS testing, and image steganography tools, although its stated goal is executable JavaScript-in-image proof of concept rather than secret-message hiding.

Sources

Project README, changelog, GitHub repository metadata, GitHub tags, and Homebrew formula metadata.

security posture

Risk level: blue

broad file, network, media, or database tool signal.

Risk classifier

blue risk · medium confidence · tool

Why

broad file, network, media, or database tool signal

Signals

text:image

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 13 platform targets.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

Command	Kind	Exposure	Note
`imagejs`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-04

manager version0.7.2

manager updated

local dataok

upstreamcurrent

latest detected0.7.2

https://github.com/jklmnn/imagejs

infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package key	brew:imagejs
Version	0.7.2
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/imagejs
Homepage	https://github.com/jklmnn/imagejs
Repository	https://github.com/jklmnn/imagejs
License	GPL-3.0-only
Source archive	https://github.com/jklmnn/imagejs/archive/refs/tags/0.7.2.tar.gz
Bottle	available (on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	imagejs
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/imagejs.yml

Used sources

Geiger risk classifier
cross-ecosystem install command graph
curated package history
package relationship graph
package version freshness
package-page enrichment
pkg.so package database
pkgdb category and tag curation

Install imagejs with Homebrew