
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Companion blog post: https://medium.com/@valgaze/npm-i-npmusic-g-npmusic-7443ac042e99#.w97n3s18l
$ npm i npmusic -g && npmusic -t && npmusic -m signe
tl;dr: Switch any npm command with “npmusic” and listen to music while it is working and when it exits, the music stops. Pointless but fun, Mac only for now, install with $ npm i npmusic -g
Happily accepting PRs here (esp for better music): https://github.com/valgaze/npmusic
For the impatient, just do this:
npm i -g npmusic && npmusic
Note: This will behind the scenes install youtube-dl & mpv if they're not already available
If everything went well (and if it didn't please get in touch) you will hear what tool is all about.
There are few things in life more exhilarating than an npm install. It’s almost like a scene from a movie… which got me thinking and tinkering and $ npmusic was born. Once installed, you can run any npm command you want normally but replace “npm” with “npmusic” and music will play in the background while it’s working. You can pick the song if you want or it will pick randomly from a list.
$ npm i npmusic -g #install
$ npmusic #play a random song, CTRL-C to shut it up
$ npmusic install #play a random song while running equivalent of $ npm install (music will turn off when done)
$ npmusic -m exciting #play an exciting song
$ npmusic -m budlight install express #play a song by pitbull and install express [alternative --mood moodName]
$ npmmusic -t #List all moods available
$ npmusic -p https://www.youtube.com/watch?v=w0N4twV28Mw #Start playing this song in your terminal [alternatively --play url]
$ npmusic -d #Play a random song but see information about song with -d flag [alternatively use --dislplay]
See $ npmusic --help for a listing of flags and how to use them
This has been tested as low as version node 4.2.6 and unfortunately for now, only Mac machines are supported.
Credits: Under the hood uses youtube-dl, mpv, and brew for the actual heavy lifting, & commader.js for CLI
If permissions on your machine are all screwed up (ie you need to run sudo or you have permissions errors), give this a shot: https://docs.npmjs.com/getting-started/fixing-npm-permissions
FAQs
Use $ npmmusic install instead of $ npm install for music while you wait
We found that npmusic demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.