Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Using NPM:
npm install --save spotifyx
Using Yarn:
yarn add spotifyx
CommonJS
const Spotify = require("spotifyx");
ES6
import Spotify from "spotifyx";
import Spotify from "spotifyx";
(async () => {
const client = new Spotify({
clientId: "a-cool-id",
clientSecret: "a-cool-secret",
});
await client.login();
console.log(await client.search("Null Magma", ["artist"]));
})();
Key:
Most typedefs are from Spotify's documentation.
Spotify
Constructs a new Spotify API client.
credentials
– Client credentials to log in
clientId
– Client IDclientSecret
– Client secretredirectUrl?
– URL to redirect toSpotify
– The newly created clientconst client = new Spotify({
clientId: "a-cool-id",
clientSecret: "a-cool-secret",
});
Spotify#token
readonly string
The client's current access token
Spotify#browse
Browser
The client's Spotify browse API
Spotify#artists
Artists
The client's Spotify artists API
Spotify#albums
Albums
The client's Spotify albums API
Spotify#tracks
Tracks
The client's Spotify tracks API
Spotify#episodes
Episodes
The client's Spotify episodes API
Spotify#shows
Shows
The client's Spotify shows API
Spotify#login
Logs the client in and creates an access token.
string
– The newly created access tokenawait client.login();
Spotify#search
Searches Spotify using Spotify's search API.
query
– Search querytypes
– Object types to search foroptions?
– Search options
market?
– Market to search withinlimit?
– Search results limitoffset?
– Search results offsetincludeExternal?
– Include externals in resultsSearchResponse
– Search resultsconst results = await client.search("Null Magma", ["artist"]);
Spotify#user
Obtains a user from Spotify using an ID.
id
– The user's IDPublicUserObject?
– User obtained from the user ID, or undefined if no user was foundconst user = await client.user("a-cool-id");
Spotify#markets
Gets all the markets.
string[]
– All marketsconst markets = await client.markets();
Browser
Wrapper for Spotify's browse API.
private
Browser#newReleases
Fetches newest releases.
options?
– Fetch options
country?
– Country codelimit?
– Fetch limitoffset?
– Fetch offsetBrowseNewReleasesResponse
– Fetched new releasesconst releases = await client.browse.newReleases({
limit: 25,
offset: 25,
});
Browser#featuredPlaylists
Fetches featured playlists.
options?
– Fetch options
country?
– Country codelocale?
– Localetimestamp?
– Timestamplimit?
– Fetch limitoffset?
– Fetch offsetBrowseFeaturedPlaylistsResponse
– Fetched featured playlistsconst playlists = await client.browse.featuredPlaylists();
Browser#allCategories
Fetches all categories.
options?
– Fetch options
country?
– Country codelocale?
– Localelimit?
– Fetch limitoffset?
– Fetch offsetBrowseAllCategoriesResponse
– Fetched categoriesconst categories = await client.browse.allCategories();
Browser#category
Fetches a category.
category
– The categoryoptions?
– Fetch options
country?
– Country codelocale?
– LocaleBrowseCategoryResponse
– Fetched categoriesconst category = await client.browse.category("party");
Browser#categoryPlaylists
Fetches a category's playlists.
category
– The categoryoptions?
– Fetch options
country?
– Country codelimit?
– Fetch limitoffset?
– Fetch offsetPagingObject<SimplifiedPlaylistObject>
– Fetched playlistsconst playlists = await client.browse.categoryPlaylists("party");
Browser#recommendations
Fetches a category's playlists.
seeds
– Seeds
artists
– Seed artistsgenres
– Seed genrestracks
- Seed tracksoptions?
– Fetch options
BrowseRecommendationsResponse
– Fetched category platlistsNot available
Browser#recommendationGenres
Fetches recommendation genres.
string[]
– Fetched genresconst genres = await client.browse.recommendationGenres();
Artists
Wrapper for Spotify's artists API.
private
Artists#get
Retrieves an artist or multiple artists.
ids
– Can either be an ID or array of IDs.If a single ID is used:
ArtistsSingleArtistResponse
– The artist retrievedIf an array of IDs is used:
ArtistsMultipleArtistsResponse
– The artists retrievedconst artists = await client.artists.get(["a-id", "another-id"]);
Artists#topTracks
Retrieves an artist's top tracks.
id
– Artist IDArtistsTopTracksResponse
– The artist's top tracksconst topTracks = await client.artists.topTracks("an-id");
Artists#related
Retrieves an artist's related artists.
id
– Artist IDArtistsRelatedArtistsResponse
– The artist's related artistsconst related = await client.artists.related("an-id");
Artists#albums
Retrieves an artist's albums.
id
– Artist IDArtistsAlbumsResponse
– The artist's albumsconst albums = await client.artists.albums("an-id");
Shows
Wrapper for Spotify's shows API.
private
Albums#get
Retrieves an album or multiple albums.
ids
– Can either be an ID or array of IDs.options?
– Fetch options
market?
– Country codeIf a single ID is used:
AlbumsSingleAlbumResponse
– The album retrievedIf an array of IDs is used:
AlbumsMultipleAlbumsResponse
– The albums retrievedconst albums = await client.albums.get(["an-id", "another-id"]);
Albums#tracks
Retrieves an album's tracks.
id
– The album's IDoptions?
– Fetch options
market
– Country codelimit
– Fetch limitoffset
– Fetch offsetAlbumsTracksResponse
– The album's tracksconst tracks = await client.albums.tracks("an-id");
Tracks
Wrapper for Spotify's tracks API.
private
Tracks#get
Retrieves a track or multiple tracks.
ids
– Can either be an ID or array of IDs.options?
– Fetch options
market?
– Country codeIf a single ID is used:
TracksSingleTrackResponse
– The track retrievedIf an array of IDs is used:
TracksMultipleTracksResponse
– The tracks retrievedTracks#audioFeatures
Retrieves a track or multiple tracks' audio features.
ids
– Can either be an ID or array of IDs.options?
– Fetch options
market?
– Country codeIf a single ID is used:
TracksSingleTrackAudioFeatureResponse
– The audio feature retrievedIf an array of IDs is used:
TracksMultipleTracksAudioFeaturesResponse
– The audio features retrievedTracks#audioAnalysis
Retrieves a track's audio analysis
id
– Track IDAudioAnalysisObject
– The audio analysisEpisodes
Wrapper for Spotify's episodes API.
private
Episodes#get
Retrieves an episode or multiple episodes.
ids
– Can either be an ID or array of IDs.options?
– Fetch options
market?
– Country codeIf a single ID is used:
EpisodesSingleEpisodeResponse
– The episode retrievedIf an array of IDs is used:
EpisodesMultipleEpisodesResponse
– The episodes retrievedShows
Wrapper for Spotify's shows API.
private
Shows#get
Retrieves a show or multiple shows.
ids
– Can either be an ID or array of IDs.options?
– Fetch options
market?
– Country codeIf a single ID is used:
ShowsSingleShowResponse
– The show retrievedIf an array of IDs is used:
ShowsMultipleShowsResponse
– The shows retrievedconst shows = await client.shows.get(["an-id", "another-id"]);
Shows#episodes
Retrieves a show's episodes.
id
– The show's IDShowsEpisodesResponse
– The episodes retrievedconst episodes = await client.shows.episodes("an-id");
FAQs
### **Fast-paced and versatile Spotify API wrapper for Node.**
We found that spotifyx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.