macOS
brew install imagejslocal Homebrew formula metadata
brew / rank 13551
Tool to hide JavaScript inside valid image files. Version 0.7.2 via Homebrew; verified from local package data.
install
brew install imagejslocal Homebrew formula metadata
overview
Tool to hide JavaScript inside valid image files
history
imagejs is a small proof-of-concept command-line tool for packaging JavaScript into files that remain valid image files. The README presents it as a way to create image files that can execute JavaScript and explicitly connects the idea to extending XSS vulnerabilities.
The project appeared on GitHub in 2014 and credits Ajin Abraham's work on GIFs serving JavaScript as the idea that inspired the C implementation. The README says imagejs added bitmap support, and the changelog shows later support for GIF injection, BMP injection, WebP injection, and additional output formats.
imagejs remained a niche security package rather than a broad media utility. GitHub repository metadata shows far more stars than package-manager breadth, and the input metadata lists Homebrew as the only package-manager mapping for this batch.
Users run imagejs with an output type and a JavaScript file, producing an image-like file named after the input. The README documents BMP, GIF, WebP, PNM, and PGF outputs, a line-viewable BMP mode, and injection into existing GIF files.
The package is interesting because it lives at the boundary between file-format polyglots and web security demonstrations. It is not a general steganography suite; it is a compact package for showing how MIME assumptions, image upload policies, and script execution contexts can collide.
security posture
broad file, network, media, or database tool signal.
blue risk · medium confidence · tool
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
imagejs | executable | indexed executable | Discovered from the local executable index. |
freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
install metadata
| Package key | brew:imagejs |
|---|---|
| Version | 0.7.2 |
| Package manager | Homebrew |
| Homepage | https://github.com/jklmnn/imagejs |
| Repository | https://github.com/jklmnn/imagejs |
| Bottle | not recorded |
| Service | none declared |
source trail
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
View the package source record on GitHub.