
Company News
Socket Partners with Replit to Block Malicious Packages in AI-Powered Development
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.
@feralfile/cli
Advanced tools
CLI for building DP-1 playlists of digital art using AI (Claude, Grok, ChatGPT, Gemini)
A small Node.js CLI for building DP-1 playlists of digital art.
Runtime: Node.js 22 or newer (matches CI and the dp1-js dependency). That engine floor is a breaking change if you previously used Node 18 or 20—check the GitHub Release for the version you move to; release authors follow docs/RELEASING.md so the notes stay explicit.
ff-cli turns a simple prompt into a DP-1–conformant playlist you can preview on an Art Computer. The model orchestrates; deterministic tools do the real work (schema validation, indexing, JSON‑LD). If something comes back invalid, validation rejects it and we loop until it’s right.
npm i -g @feralfile/cli
curl -fsSL https://feralfile.com/ff-cli-install | bash
Installs a prebuilt binary for macOS/Linux (no Node.js required).
npx @feralfile/cli setup
npx @feralfile/cli chat
Set your LLM API key first (default Claude): export ANTHROPIC_API_KEY='sk-ant-your-api-key-here'
ff-cli setup
ff-cli chat
ff-cli play "https://example.com/video.mp4" --skip-verify
If you need manual config actions instead of guided setup:
ff-cli config init
ff-cli config validate
ff-cli find resolves a URL, raw chain:contract:tokenId, or a wallet address into a playable DP-1 playlist. The focus is computational and generative art; PFP collections and pre-ERC-721 contracts have limits noted below.
# Most satisfying: paste a URL, play it on your FF1
ff-cli find https://www.artblocks.io/collection/ringers-by-dmitri-cherniak --play
# Tezos / hic et nunc via Objkt (the alias resolves to a KT1 contract)
ff-cli find https://objkt.com/tokens/hicetnunc/111068 --play
# Feral File artwork (public id can be hex or numeric — both forms resolve via /api/artworks)
ff-cli find https://feralfile.com/exhibitions/artwork/f0240e04d64717e319584957f6a83954b029254ad1260b6320472ea8c0c5b1cf --play
# Save without playing
ff-cli find ethereum:0xababababab20053426ad1c782de9ea8444358070:5001410 --output send-receive.json
Sources: Art Blocks, Objkt, fxhash (canonical /gentk/..., live /iteration/{slug}, and project pages /project/{slug} / /generative/{slug}), OpenSea, SuperRare, Feral File, Neort (/art/{id}), raw on-chain coords, wallet addresses. Run ff-cli find --help for the full input list.
Known limitations
--limit N.ff-cli ships a Claude Code skill at skills/ff-control/SKILL.md. Install it once:
git clone --depth=1 https://github.com/feral-file/ff-cli /tmp/ff-cli \
&& mkdir -p ~/.claude/skills \
&& cp -r /tmp/ff-cli/skills/ff-control ~/.claude/skills/
Claude Code will surface it when you ask to build a playlist, play an artwork or URL on an Art Computer, or publish to a feed. The skill validates config, builds, validates the playlist, and sends or publishes — reporting the failing command + exit code if anything breaks. Full prompt and exact flow: skills/ff-control/SKILL.md.
ff-cli ships the same ff-control skill in Codex's native skill format. Install it once:
git clone --depth=1 https://github.com/feral-file/ff-cli /tmp/ff-cli \
&& mkdir -p ~/.codex/skills \
&& cp -r /tmp/ff-cli/skills/ff-control ~/.codex/skills/
Codex will surface it when you ask to build a playlist, play an artwork or URL on an Art Computer, or publish to a feed. The installed skill is skills/ff-control/SKILL.md, so the execution flow stays defined in one place. Codex metadata and exact flow: skills/ff-control/agents/openai.yaml, skills/ff-control/SKILL.md.
Set your LLM API key first (default Claude): export ANTHROPIC_API_KEY='sk-ant-your-api-key-here'
npm ci
npm run dev -- setup
npm run dev -- chat
npm run dev -- play "https://example.com/video.mp4" --skip-verify
./docs/README.md./docs/CONFIGURATION.md./docs/FUNCTION_CALLING.md./docs/EXAMPLES.mdff-cli ssh enable|disable in ./docs/README.mdGitHub Actions runs .github/workflows/ci.yml for pull requests, pushes to main/master, and reusable workflow_call jobs. CI uses Node.js 22, installs dependencies with npm ci, sets ANTHROPIC_API_KEY=dummy, and runs the repo-wide verification entrypoint:
ANTHROPIC_API_KEY=dummy npm run verify
Run the same command locally before opening a PR. It checks formatting, lint, tests, TypeScript build, playlist validation smoke, and config validation smoke without mutating source files.
Other GitHub Actions workflows:
.github/workflows/build.yml builds release assets when called by release automation or manually dispatched..github/workflows/release.yml reuses CI, verifies the release version, publishes npm, uploads assets, and checks the published release..github/workflows/dependency-review.yml reviews dependency changes on pull requests..github/workflows/codeql.yml runs CodeQL analysis on pull requests and pushes to main/master.npm run dev # Run CLI in dev (tsx)
npm run build # Build TypeScript
npm run check # Format check + lint + tests
npm run smoke # Build + CLI smoke checks
npm run verify # CI-equivalent validation entrypoint
npm run lint:fix # Optional mutating lint fix; review changes before committing
MIT
FAQs
CLI for building DP-1 playlists of digital art using AI (Claude, Grok, ChatGPT, Gemini)
The npm package @feralfile/cli receives a total of 188 weekly downloads. As such, @feralfile/cli popularity was classified as not popular.
We found that @feralfile/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.