Maintained compatibility package

@stackline/png-chunks-extract

Extract PNG chunks synchronously after proving every declared byte and validating every CRC—including IEND.

Start here

One callable function

npm install @stackline/png-chunks-extract@1.0.1

CommonJS

const extract = require('@stackline/png-chunks-extract')
const chunks = extract(bytes)

ES modules

import extract from '@stackline/png-chunks-extract'
const chunks = extract(bytes)

Input may be a Buffer or Uint8Array. Output is an ordered array of { name, data } objects whose payloads are detached Uint8Array copies.

Bounded parsing

Check the envelope before the allocation

Complete boundaries

Length, four-byte type, complete payload, and four-byte CRC must all fit before any payload allocation or copy.

PNG size ceiling

Declared chunk payloads above 2^31 - 1 bytes fail immediately with a stable RangeError.

Every CRC

An internal IEEE CRC-32 implementation validates type plus payload for ordinary chunks and zero-length IEND.

Historical valid behavior

IHDR remains first, unknown and duplicate chunk types remain observable, and a valid IEND ends extraction.

This package validates chunk framing and integrity, not decoded image semantics. It deliberately ignores bytes after a valid IEND for upstream compatibility.

Malformed input

Deterministic field-level failures

Validation boundaries and failure category
Boundary	Result
Input type or signature	`TypeError` or the historical invalid-header error
Length over PNG maximum	`RangeError` before declaration-sized work
Partial field	Error names truncated length, type, data, or CRC
First chunk	Historical `IHDR header missing`
CRC	Historical chunk-specific mismatch message
`IEND`	Must be present, empty, complete, and CRC-valid

Adoption

Keep the historical import key

An npm alias lets existing require('png-chunks-extract') and default imports remain unchanged.

{
  "dependencies": {
    "png-chunks-extract": "npm:@stackline/png-chunks-extract@1.0.1"
  }
}

Run a clean install, the downstream test/build suite, one representative valid PNG, and malformed checks for a missing IEND CRC and a huge declared length without payload.

Release evidence

What the package gate covers

Exact upstream differential streams and generated README fixtures.
All incomplete fields, CRC and IEND regressions, deterministic fuzzing, and bounded large declarations.
20,000 chunks, an 8 MiB payload, CommonJS, ESM, browser bundling, npm alias, and TypeScript 3.9/current.
Strict package/type lint, licenses, one-node closure, CycloneDX SBOM, audits, and release inventory.

Verification guide · Full compatibility contract · Migration guide · Security policy

Independent maintenance and attribution

This package is independently maintained and is not affiliated with or endorsed by Hugh Kennedy or the original project. Original MIT attribution is preserved.