
Security News
AI Has Taken Over Open Source
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain
@nuclearplayer/plugin-sdk
Advanced tools
Build plugins for Nuclear music player.
Plugins are JavaScript/TypeScript modules that extend Nuclear's functionality. Write lifecycle hooks, register providers, and ship it as an npm package or local bundle.
mkdir my-plugin && cd my-plugin
pnpm init -y
pnpm add @nuclearplayer/plugin-sdk
Create src/index.ts:
import { NuclearPluginAPI } from '@nuclearplayer/plugin-sdk';
export default {
async onLoad(api: NuclearPluginAPI) {
console.log('Plugin loaded');
},
async onEnable(api: NuclearPluginAPI) {
console.log('Plugin enabled');
},
async onDisable() {
console.log('Plugin disabled');
},
async onUnload() {
console.log('Plugin unloaded');
},
};
Build it to dist/index.js as a CommonJS bundle.
name - Unique plugin ID (scoped names allowed)version - Semver versiondescription - One-line summaryauthor - Your namemain - Entry file path (defaults to index.js or dist/index.js)Add a nuclear object for extra metadata:
displayName - Friendly name (defaults to name)category - Arbitrary grouping (e.g., source, integration, lyrics)icon - See belowpermissions - Capabilities your plugin uses (informational only for now){
"name": "@nuclear-plugin/lastfm",
"version": "0.1.0",
"description": "Scrobble tracks to Last.fm",
"author": "Nuclear Team",
"main": "dist/index.js",
"nuclear": {
"displayName": "Last.fm Scrobbler",
"category": "integration",
"icon": { "type": "link", "link": "https://example.com/icon.png" },
"permissions": ["scrobble", "network"]
}
}
type PluginIcon = { type: 'link'; link: string };
Link icons should point to a local file path or remote URL; keep them small (<= 64x64, optimized).
All hooks are optional. Export a default object with any of:
onLoad(api) - Runs after plugin code loads and manifest is parsedonEnable(api) - Runs when user enables the pluginonDisable() - Runs when user disables itonUnload() - Runs before plugin is removed from memoryexport default {
async onLoad(api) {
},
async onEnable(api) {
},
async onDisable() {
},
async onUnload() {
},
};
The api object passed to lifecycle hooks provides access to these domain APIs:
| API | Description |
|---|---|
api.Settings | Define, read, and persist plugin settings |
api.Queue | Read and manipulate the playback queue |
api.Favorites | Manage the user's favorite tracks |
api.Providers | Register and unregister providers |
api.Streaming | Resolve audio stream URLs for tracks |
api.Metadata | Search and fetch artist/album/track details |
api.Dashboard | Fetch dashboard content (top tracks, new releases, etc.) |
See the full documentation for detailed guides on each API.
Declare what your plugin does in the permissions array. Permissions are currently informational. Future versions might show UI for this.
Examples: network, scrobble, playback-control, lyrics, search, storage
my-plugin/
package.json
src/
index.ts
dist/
index.js
You can use any bundler that outputs a single JS file. Your bundle needs to work in a CommonJS environment (module.exports or exports.default).
Example with tsup:
{
"devDependencies": { "tsup": "^8" },
"scripts": { "build": "tsup src/index.ts --dts --format cjs --minify --out-dir dist" }
}
Run pnpm build and you'll get dist/index.js.
onEnable| Problem | Solution |
|---|---|
| Can't find entry file | Check main in package.json or make sure index.js or dist/index.js exists |
| Missing fields error | Add all required fields: name, version, description, author |
| Hooks don't fire | Export a default object, not a function or class |
import type {
NuclearPlugin,
PluginManifest,
PluginIcon,
// Model types (re-exported from @nuclearplayer/model)
Artist,
Album,
Track,
// ... and many more
} from '@nuclearplayer/plugin-sdk';
AGPL-3.0-only
FAQs
Plugin SDK for Nuclear music player
We found that @nuclearplayer/plugin-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain

Security News
npm invalidated all granular access tokens that bypass 2FA after a fresh Mini Shai-Hulud wave compromised 323 npm packages. Staged publishing also entered public preview.

Research
/Security News
Compromised npm package art-template delivered a Coruna-like iOS Safari exploit framework through a watering-hole attack.