Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@tidal-music/player
Advanced tools
npm install @tidal-music/player
(or similar for other package managers)
Then see the docs or the examples elsewhere in this repository.
The src/ folder contains the source code. Structured under api/ is the outside facing API. The player/ folder contains the underlying players and their integration into TIDAL player. The internal/ folder the business logic that the outside facing API end up calling.
The dist/ folder contains the latest built version of the code in src/.
Building is done with Vite.
pnpm build
to build the package to dist/
pnpm test
. You need a .env
file containing TEST_USER="base64string"
before running. base64string is base 64 encoded stringified JS object containing oAuthAccessToken, oAuthRefreshToken, oAuthExpirationDate and clientId.
To load TIDAL Player into a project locally without publishing to npm; using pnpm link
, yarn link
or npm link
can be problematic, especially if your project does not also use pnpm like this repo does. If so, you need to manually configure a "hard link" using the file:
protocol in package.json of the destination project like so:
"resolutions"
property on the top level. (this is an object)"@tidal-music/player": "file:/Users/<your-username>/dev/tidal-sdk-web/packages/player"
npm/yarn/pnpm install
in your destination project.!! Remove the entry in "resolution"
and run npm/yarn/pnpm install
again when you are done testing to have the NPM version of the package load instead.
Run the patch-shaka
script to get TS working for shaka-player.
FAQs
Player logic for TIDAL
The npm package @tidal-music/player receives a total of 23 weekly downloads. As such, @tidal-music/player popularity was classified as not popular.
We found that @tidal-music/player demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.