pkg.soopen package index

brew / rank 13551

Install imagejs with Homebrew

Tool to hide JavaScript inside valid image files. Version 0.7.2 via Homebrew; verified from local package data.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install imagejs

local Homebrew formula metadata

overview

Package summary

Tool to hide JavaScript inside valid image files

Commands and aliases

  • imagejs

history

Project history and usage

imagejs is a small proof-of-concept command-line tool for packaging JavaScript into files that remain valid image files. The README presents it as a way to create image files that can execute JavaScript and explicitly connects the idea to extending XSS vulnerabilities.

Project history

The project appeared on GitHub in 2014 and credits Ajin Abraham's work on GIFs serving JavaScript as the idea that inspired the C implementation. The README says imagejs added bitmap support, and the changelog shows later support for GIF injection, BMP injection, WebP injection, and additional output formats.

Adoption history

imagejs remained a niche security package rather than a broad media utility. GitHub repository metadata shows far more stars than package-manager breadth, and the input metadata lists Homebrew as the only package-manager mapping for this batch.

How it is used

Users run imagejs with an output type and a JavaScript file, producing an image-like file named after the input. The README documents BMP, GIF, WebP, PNM, and PGF outputs, a line-viewable BMP mode, and injection into existing GIF files.

Why package nerds care

The package is interesting because it lives at the boundary between file-format polyglots and web security demonstrations. It is not a general steganography suite; it is a compact package for showing how MIME assumptions, image upload policies, and script execution contexts can collide.

Timeline

  • 2014: GitHub repository is created.
  • 0.4.1: GIF, BMP, WebP, PNM, and PGF output support is documented in the changelog.
  • 0.5.0: GIF injection support is added.
  • 0.6.0: BMP injection support is added.
  • 0.7.0: WebP injection support is added.

Related projects

  • The README names Ajin Abraham's GIF/JavaScript work as the source idea. Conceptually, imagejs is related to polyglot-file demos, browser XSS testing, and image steganography tools, although its stated goal is executable JavaScript-in-image proof of concept rather than secret-message hiding.

Sources

  • Project README, changelog, GitHub repository metadata, GitHub tags, and Homebrew formula metadata.

security posture

Risk level: blue

broad file, network, media, or database tool signal.

Risk classifier

blue risk · medium confidence · tool

Why

  • broad file, network, media, or database tool signal

Signals

  • text:image

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
imagejsexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version0.7.2
manager updated
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:imagejs
Version0.7.2
Package managerHomebrew
Homepagehttps://github.com/jklmnn/imagejs
Repositoryhttps://github.com/jklmnn/imagejs
Bottlenot recorded
Servicenone declared

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • pkg.so package database
  • pkgdb category and tag curation