
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@audius/sdk
Advanced tools
The Audius JavaScript (TypeScript) SDK allows you to easily interact with the Audius protocol. Use the SDK to:
...and much more!
Audius offers two API plans:
| Plan | Rate Limit | Monthly Requests |
|---|---|---|
| Free | 10 requests/second | 500,000 requests/month |
| Unlimited | Unlimited | Unlimited |
The Free plan is always free with no restrictions. For higher limits and support, contact api@audius.co about the Unlimited plan.
Visit the Audius API Plans page and click "Create API Key" to generate your credentials.
You will receive an API Key and a Bearer Token. Save both securely — treat them like passwords.
:::tip
The bearer token is the recommended way to authenticate with the Audius API.
:::
If your project is in a Node.js environment, run this in your terminal:
npm install @audius/sdk
Otherwise, include the SDK script tag in your web page. The Audius SDK will then be assigned to window.audiusSdk.
<script src="https://cdn.jsdelivr.net/npm/@audius/sdk@latest/dist/sdk.min.js"></script>
Initialize the SDK with your API key and bearer token.
import { sdk } from '@audius/sdk'
const audiusSdk = sdk({
apiKey: 'Your API Key goes here',
bearerToken: 'Your Bearer Token goes here'
})
const audiusSdk = window.audiusSdk({
apiKey: 'Your API Key goes here',
bearerToken: 'Your Bearer Token goes here'
})
:::warning
DO NOT include the bearer token if you are runing the SDK in the browser or anywhere in the client. The bearer token is what allows your app to write on behalf of the users that have authorized it to do so. Keep your bearer token secure and never expose it in client-side code that could be inspected.
:::
Once you have the initialized SDK instance, it's smooth sailing to making your first API calls.
// Fetch your first track!
const track = await audiusSdk.tracks.getTrack({ trackId: 'D7KyD' })
console.log(track, 'Track fetched!')
// Favorite a track
const userId = (
await audiusSdk.users.getUserByHandle({
handle: 'Your Audius handle goes here'
})
).data?.id
await audiusSdk.tracks.favoriteTrack({
trackId: 'D7KyD',
userId
})
import { sdk } from '@audius/sdk'
const audiusSdk = sdk({
apiKey: 'Your API Key goes here',
bearerToken: 'Your Bearer Token goes here'
})
const track = await audiusSdk.tracks.getTrack({ trackId: 'D7KyD' })
console.log(track, 'Track fetched!')
const userId = (
await audiusSdk.users.getUserByHandle({
handle: 'Your Audius handle goes here'
})
).data?.id
await audiusSdk.tracks.favoriteTrack({
trackId: 'D7KyD',
userId
})
console.log('Track favorited!')
<!DOCTYPE html>
<html>
<head>
<script src="https://cdn.jsdelivr.net/npm/@audius/sdk@latest/dist/sdk.min.js"></script>
<script>
const fn = async () => {
const audiusSdk = window.audiusSdk({
apiKey: 'Your API Key goes here'
})
const track = await audiusSdk.tracks.getTrack({ trackId: 'D7KyD' })
console.log(track, 'Track fetched!')
}
fn()
</script>
</head>
<body>
<h1>Example content</h1>
</body>
</html>
Get authorization to access your app's users' Audius accounts
Explore the API docs to see what else you can do with the Audius SDK
You can also access the Audius API directly without the SDK:
REST API:
curl -X GET "https://api.audius.co/v1/tracks/trending" \
-H "Authorization: Bearer <YOUR-API-BEARER-TOKEN>"
gRPC:
grpcurl -H "authorization: Bearer <YOUR-API-BEARER-TOKEN>" \
grpc.audius.co:443 list
For more details, visit the API documentation or the Swagger definition.
FAQs
Audius SDK
The npm package @audius/sdk receives a total of 984 weekly downloads. As such, @audius/sdk popularity was classified as not popular.
We found that @audius/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.