
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@feralfile/cli
Advanced tools
CLI for building DP-1 playlists of digital art using AI (Claude, Grok, ChatGPT, Gemini)
A small Node.js CLI for building DP-1 playlists of digital art.
Runtime: Node.js 22 or newer (matches CI and the dp1-js dependency). That engine floor is a breaking change if you previously used Node 18 or 20—check the GitHub Release for the version you move to; release authors follow docs/RELEASING.md so the notes stay explicit.
ff-cli turns a simple prompt into a DP-1–conformant playlist you can preview on an Art Computer. The model orchestrates; deterministic tools do the real work (schema validation, indexing, JSON‑LD). If something comes back invalid, validation rejects it and we loop until it’s right.
npm i -g @feralfile/cli
curl -fsSL https://feralfile.com/ff-cli-install | bash
Installs a prebuilt binary for macOS/Linux (no Node.js required).
npx @feralfile/cli setup
npx @feralfile/cli chat
Set your LLM API key first (default Claude): export ANTHROPIC_API_KEY='sk-ant-your-api-key-here'
ff-cli setup
ff-cli chat
ff-cli play "https://example.com/video.mp4" --skip-verify
If you need manual config actions instead of guided setup:
ff-cli config init
ff-cli config validate
Set your LLM API key first (default Claude): export ANTHROPIC_API_KEY='sk-ant-your-api-key-here'
npm ci
npm run dev -- setup
npm run dev -- chat
npm run dev -- play "https://example.com/video.mp4" --skip-verify
./docs/README.md./docs/CONFIGURATION.md./docs/FUNCTION_CALLING.md./docs/EXAMPLES.mdff-cli ssh enable|disable in ./docs/README.mdGitHub Actions runs .github/workflows/ci.yml for pull requests, pushes to main/master, and reusable workflow_call jobs. CI uses Node.js 22, installs dependencies with npm ci, sets ANTHROPIC_API_KEY=dummy, and runs the repo-wide verification entrypoint:
ANTHROPIC_API_KEY=dummy npm run verify
Run the same command locally before opening a PR. It checks formatting, lint, tests, TypeScript build, playlist validation smoke, and config validation smoke without mutating source files.
Other GitHub Actions workflows:
.github/workflows/build.yml builds release assets when called by release automation or manually dispatched..github/workflows/release.yml reuses CI, verifies the release version, publishes npm, uploads assets, and checks the published release..github/workflows/dependency-review.yml reviews dependency changes on pull requests..github/workflows/codeql.yml runs CodeQL analysis on pull requests and pushes to main/master.npm run dev # Run CLI in dev (tsx)
npm run build # Build TypeScript
npm run check # Format check + lint + tests
npm run smoke # Build + CLI smoke checks
npm run verify # CI-equivalent validation entrypoint
npm run lint:fix # Optional mutating lint fix; review changes before committing
MIT
FAQs
CLI for building DP-1 playlists of digital art using AI (Claude, Grok, ChatGPT, Gemini)
The npm package @feralfile/cli receives a total of 188 weekly downloads. As such, @feralfile/cli popularity was classified as not popular.
We found that @feralfile/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.