
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
Lightweight YouTube video metadata and streaming URL extractor for Node.js. Features automatic signature decryption (n-parameter), proxy support, and cookie management. Ported from yt-dlp.
A lightweight YouTube metadata and streaming URL scraper for Node.js, featuring proxy and cookie support. Ported from yt-dlp.
undici.npm install untube
import { getVideoInfo } from 'untube';
async function main() {
try {
const info = await getVideoInfo('videoId', {
// Optional: Path to cookies file (Netscape format) or RawCookie object
cookie: './cookies.txt',
// Optional: Use proxy to avoid rate limits or blocks
proxy: 'http://user:pass@my-proxy.com:8080'
});
console.log('Title:', info.title);
console.log('Channel:', info.uploader);
// List available video & audio formats
info.formats.forEach(format => {
console.log(`[${format.format_id}] ${format.resolution} - ${format.url}`);
});
} catch (error) {
console.error('Failed to fetch info:', error);
}
}
main();
Using cookies is highly recommended to avoid rate limits, access age-restricted (NSFW) videos, or videos only available in specific regions.
cookies.txt in your project directory.cookie option.If you want to store cookies in a remote database or as a string, use the RawCookie class:
import { getVideoInfo, RawCookie } from 'untube';
const myRawCookie = new RawCookie(
async () => {
// Implement your own read logic (e.g., from Firebase Realtime DB)
const cookies = await fetchCookiesFromDB();
return cookies; // Must return Netscape format string
},
async (newCookies) => {
// Implement your own write logic
// This is called whenever YouTube sends new cookies
await saveCookiesToDB(newCookies);
}
);
const info = await getVideoInfo('videoId', {
cookie: myRawCookie
});
⚠️ Security: Never share your cookies with anyone as they contain your login session. Ensure local cookie files are added to your
.gitignore.
This project is created for educational and research purposes only. Users are solely responsible for how they use this tool. Ensure you comply with YouTube's Terms of Service and applicable copyright laws in your region. The author is not responsible for any misuse of this tool.
FAQs
Lightweight YouTube video metadata & streaming URL extractor for Node.js. High reliability ported from yt-dlp
The npm package untube receives a total of 276 weekly downloads. As such, untube popularity was classified as not popular.
We found that untube demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.