@amplitude/rrweb-packer

The @amplitude/rrweb-packer provides straightforward compression/decompression for rrweb session replay events using the `pack()` and `unpack()` functions. The API surface is minimal—essentially two methods—which makes it easy to integrate once you understand what it does. However, the package sits at version 2.0.0-alpha.35, which immediately raises stability concerns for production use.

Documentation is sparse at best. The README provides basic usage examples, but there's little explanation of the compression algorithm used, size reduction expectations, or performance characteristics. TypeScript definitions exist and work adequately for the simple API, but you won't get much help understanding edge cases or error scenarios. Error handling is basic—invalid input will throw, but error messages aren't particularly helpful for debugging.

The package does what it claims: it compresses rrweb events and reduces payload sizes. For teams already committed to the Amplitude/rrweb ecosystem and needing compression, it integrates smoothly. However, the alpha status, limited documentation, and lack of guidance on migration paths make it feel incomplete for mission-critical implementations.

The @amplitude/rrweb-packer does what it promises—compressing rrweb session replay events using pack() and unpack() functions. The API surface is refreshingly simple: import the functions, pass your events, get compressed output. TypeScript definitions exist and work adequately for basic usage.

However, the alpha version status shows. Documentation is practically nonexistent beyond a basic README. There are no inline JSDoc comments to guide IDE users, making it unclear what format pack() expects or returns without diving into source code. Error messages are generic JavaScript errors rather than actionable guidance when you pass malformed data.

The migration path from @rrweb/packer (the original) to this Amplitude fork is undocumented, which is problematic if you're upgrading existing implementations. For a utility package that should "just work," you'll spend more time than expected figuring out integration details through trial and error.

This package does what it says - compresses rrweb event streams using pako (zlib). The API is straightforward with pack() and unpack() methods that handle binary data conversion transparently. In practice, it reduces session replay payloads by 60-80%, which is significant for bandwidth and storage.

The security concerns are notable though. Being an alpha release (2.0.0-alpha.35) in production is risky from a stability and security maintenance perspective. The package has minimal input validation - it expects well-formed rrweb events but doesn't deeply validate structure before compression, which could lead to issues if untrusted data flows through. Error handling is basic; exceptions from pako bubble up without sanitization, potentially exposing implementation details. No built-in safeguards against compression bombs or payload size limits exist.

Dependency-wise, it's lean (mainly pako), which limits supply chain exposure. However, the alpha status means CVE response patterns are unproven. For session replay data containing PII, you'll need to implement your own validation and sanitization layers before compression.