
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Just another CLI tool for downloading Bilibili streams
Prerequisites: install ffmpeg for merging tracks and add it to env path. For Homebrew users:
brew install ffmpeg
npm install -g bldl
bldl --help
Commands:
bldl <url> [output] Download stream [default]
bldl login <credential> Login to download higher quality streams
bldl whoami Display Bilibili username
Positionals:
url URL to download stream from [string]
output Path to save stream to [string]
Options:
--version Show version number [boolean]
--credential Bilibili SESSDATA from browser Cookies [string]
-i, --interactive Interactively download streams
[boolean] [default: false]
--video-codec Filter out video tracks by given codec, e.g. avc, hevc, av1
, or more exact codec string [string]
--audio-codec Filter out audio tracks by given codec [string]
--tmp-dir Directory to save temporary tracks
[string] [default: "{OS_TMP_DIR}/bldl"]
--keep-tmp-tracks Whether to keep temporary tracks after merging
[boolean] [default: false]
--help Show help [boolean]
bldl login {SESSDATA_FROM_COOKIES} # Store Bilibli auth credential for downloading high quality streams
bldl BV1j4411W7F7 # UGC video
bldl https://www.bilibili.com/video/BV1j4411W7F7 # UGC video
bldl https://www.bilibili.com/bangumi/play/ep199612 # PGC episode
bldl https://www.bilibili.com/bangumi/play/ss12548 # PGC season
Or for one-off use:
npx bldl --credential={SESSDATA_FROM_COOKIES} https://www.bilibili.com/video/BV1j4411W7F7
FAQs
A CLI tool for downloading Bilibili streams
The npm package bldl receives a total of 1 weekly downloads. As such, bldl popularity was classified as not popular.
We found that bldl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.