
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
tafrigh-cli
Advanced tools
tafrigh-cli is a Bun-powered command-line interface for the tafrigh transcription engine. It orchestrates downloading media, chunking audio, performing speech-to-text and formatting transcripts for rapid review.
The CLI is composed of small utilities documented with JSDoc and individually tested so that media discovery, option parsing and configuration persistence remain easy to maintain. The sections below highlight the most frequently used modules when extending the tool.
conf.pino + pino-pretty for actionable CLI feedback.| Location | Purpose |
|---|---|
src/index.ts | CLI entrypoint that wires meow options to tafrigh execution. |
src/utils/mediaUtils.ts | Detects supported URLs, crawls playlists and discovers download targets using yt-dlp. |
src/utils/optionsMapping.ts | Normalizes CLI flags into tafrigh-friendly option objects. |
src/utils/config.ts | Persists per-language wit.ai credentials using conf. |
src/utils/io.ts | File system helpers for globbing media, verifying paths and ensuring output folders exist. |
src/utils/prompt.ts | Simplified prompt helpers for collecting credentials interactively. |
python3 in your system PATH (required by yt-dlp)The CLI uses youtube-dl-exec which wraps yt-dlp for YouTube downloads. The yt-dlp binary is auto-installed during bun install, but you can also use a global installation.
Install dependencies with Bun:
bun install
To run the CLI without installing globally, use bunx:
bunx tafrigh-cli --help
bunx tafrigh-cli [options] <inputs...>
| Flag | Alias | Description |
|---|---|---|
--chunk-duration | -d | Split audio into fixed-size segments (seconds). Default: 300. |
--concurrency | -c | Number of tafrigh worker threads. |
--keys | -k | wit.ai API keys. Repeat flag for multiple keys. Persisted per language. |
--language | -l | Namespace API keys for a locale. Default: global. |
--output | -o | Output file (single input) or directory (multiple inputs). |
Transcribe a local video and open the output automatically:
bunx tafrigh-cli "./video.mp4" --output "./transcript.txt" --keys "ABC" --keys "DEF"
Process an entire playlist using Arabic-specific keys:
bunx tafrigh-cli "https://www.youtube.com/playlist?list=abcd" \
--output "./transcripts" \
--language ar \
--keys "XYZ"
Reuse stored keys for multiple mixed sources:
bunx tafrigh-cli \
"https://www.facebook.com/watch/?v=1234" \
"https://www.youtube.com/watch?v=5678" \
"https://x.com/user/status/9012" \
--output "./batch-output"
| Command | Description |
|---|---|
bun run build | Bundles the CLI through tsdown using tsdown.config.ts. |
bun test | Runs the Bun test suite (bun:test). |
bun run lint | Lints the project with Biome. |
bun run format | Formats sources with Biome. |
The bundler configuration lives in tsdown.config.ts and is consumed directly by tsdown. Unit tests live beside their helpers as src/**/*.test.ts files so behaviour is verified right next to the implementation.
The CLI emits structured logs describing preprocessing, transcription progress and output destinations. Adjust LOG_LEVEL to change verbosity.
v1.4.3+: Migrated from @distube/ytdl-core and @distube/ytpl to youtube-dl-exec for improved reliability and active maintenance. This requires Python 3.7+ for yt-dlp to function.
MIT © Ragaeeb Haq
FAQs
CLI for using the tafrigh library.
We found that tafrigh-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.