# Install imagejs with Homebrew Tool to hide JavaScript inside valid image files. Version 0.7.2 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:imagejs ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install imagejs ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:imagejs - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.7.2 - **Source summary:** Tool to hide JavaScript inside valid image files - **Homepage:** - **Repository:** - **License:** GPL-3.0-only - **Source archive:** - **Generated:** 2026-08-04T22:13:35+00:00 ## Executables - imagejs (cli) - imagejs (alias) ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_big_sur, arm64_linux, arm64_monterey, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, big_sur, catalina, monterey, sonoma, ventura ## Freshness - Page generated: 2026-08-04 - Package-manager version: 0.7.2 - Local data: ok - Upstream repository: https://github.com/jklmnn/imagejs - Upstream latest detected: 0.7.2 (current) - info: No package-manager update timestamp was available. ## Project history and usage imagejs is a small proof-of-concept command-line tool for packaging JavaScript into files that remain valid image files. The README presents it as a way to create image files that can execute JavaScript and explicitly connects the idea to extending XSS vulnerabilities. ### Project history The project appeared on GitHub in 2014 and credits Ajin Abraham's work on GIFs serving JavaScript as the idea that inspired the C implementation. The README says imagejs added bitmap support, and the changelog shows later support for GIF injection, BMP injection, WebP injection, and additional output formats. ### Adoption history imagejs remained a niche security package rather than a broad media utility. GitHub repository metadata shows far more stars than package-manager breadth, and the input metadata lists Homebrew as the only package-manager mapping for this batch. ### How it is used Users run imagejs with an output type and a JavaScript file, producing an image-like file named after the input. The README documents BMP, GIF, WebP, PNM, and PGF outputs, a line-viewable BMP mode, and injection into existing GIF files. ### Why package nerds care The package is interesting because it lives at the boundary between file-format polyglots and web security demonstrations. It is not a general steganography suite; it is a compact package for showing how MIME assumptions, image upload policies, and script execution contexts can collide. ### Timeline - 2014: GitHub repository is created. - 0.4.1: GIF, BMP, WebP, PNM, and PGF output support is documented in the changelog. - 0.5.0: GIF injection support is added. - 0.6.0: BMP injection support is added. - 0.7.0: WebP injection support is added. ### Related projects - The README names Ajin Abraham's GIF/JavaScript work as the source idea. Conceptually, imagejs is related to polyglot-file demos, browser XSS testing, and image steganography tools, although its stated goal is executable JavaScript-in-image proof of concept rather than secret-message hiding. ### Sources - Project README, changelog, GitHub repository metadata, GitHub tags, and Homebrew formula metadata. ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** imagejs - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Source-control packages](https://pkg.so/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://pkg.so/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://pkg.so/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [retire](https://pkg.so/brew/retire/) - Shares pkgdb curated category or tags: cli, javascript, security. - [mantra](https://pkg.so/brew/mantra/) - Shares pkgdb curated category or tags: cli, javascript, security. - [openssl@3](https://pkg.so/brew/openssl-3/) - Shares pkgdb curated category or tags: cli, security. - [gnutls](https://pkg.so/brew/gnutls/) - Shares pkgdb curated category or tags: cli, security. - [p11-kit](https://pkg.so/brew/p11-kit/) - Shares pkgdb curated category or tags: cli, security. - [gnupg](https://pkg.so/brew/gnupg/) - Shares pkgdb curated category or tags: cli, security. - [krb5](https://pkg.so/brew/krb5/) - Shares pkgdb curated category or tags: cli, security. - [nettle](https://pkg.so/brew/nettle/) - Shares pkgdb curated category or tags: cli, security. - [binwalk](https://pkg.so/brew/binwalk/) - Both packages work with overlapping file formats or content types. Shared terms: cli, files, image, security. - [urlfinder](https://pkg.so/brew/urlfinder/) - Both packages touch the same language runtime or ecosystem. Shared terms: cli, files, javascript, security. - [exif-be-gone](https://pkg.so/npm/exif-be-gone/) - Both packages work with overlapping file formats or content types. Shared terms: cli, files, image, security. ## Combined YAML source View the package source record on GitHub. [combined/imagejs.yml](https://github.com/mxcl/pkgdb/blob/main/combined/imagejs.yml) ## Sources - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - cross-ecosystem install command graph