
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
youtube-api-thumbnails
Advanced tools
Requests Youtube API for all thumbnails related to Youtube Video IDs
Get Youtube thumbnails via Youtube API
Follow the official Google tutorial to obtain API KEY
You need a Google Account to access the Google API Console, request an API key, and register your application.
Create a project in the Google Developers Console and obtain authorization credentials so your application can submit API requests.
After creating your project, make sure the YouTube Data API is one of the services that your application is registered to use:
In Credentials in left menu you can generate your API key
$ npm install youtube-api-thumbnails
Call the module
var thumbnails = require('youtube-api-thumbnails');
Configuration
thumbnails.config({
key: "<your Youtube API key>", // required
returnAsArray: true, // optional, default is false
onlyHighestRes: true, // optional, default is false
getResolutions: true // optional, default is false
})
Get Youtube video thumbnails
thumbnails.get(id, callback);
Array of youtube videos ID
If error appears err contains error message else is null.
thumbnails is an object with videos ID and links to their thumbnails. Check examples for more information
thumbnails.get([ 'aaa' , 'Z0ZUwh8GOo0' , 'Rh9a1ICbIJE' ], function (err, thumbnails) {
if(err){
console.log(err);
return;
}
console.log(thumbnails);
});
Only existing videos will appear in result so video ID 'aaa' will be missing
With default configuration ( only key set )
[
Z0ZUwh8GOo0: {
default: 'https://i.ytimg.com/vi/Z0ZUwh8GOo0/default.jpg',
medium: 'https://i.ytimg.com/vi/Z0ZUwh8GOo0/mqdefault.jpg',
high: 'https://i.ytimg.com/vi/Z0ZUwh8GOo0/hqdefault.jpg',
standard: 'https://i.ytimg.com/vi/Z0ZUwh8GOo0/sddefault.jpg' },
Rh9a1ICbIJE: {
default: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/default.jpg',
medium: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/mqdefault.jpg',
high: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/hqdefault.jpg',
standard: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/sddefault.jpg',
maxres: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/maxresdefault.jpg' }
]
If returnAsArray is set to true in config
[
Z0ZUwh8GOo0: [
'https://i.ytimg.com/vi/Z0ZUwh8GOo0/default.jpg',
'https://i.ytimg.com/vi/Z0ZUwh8GOo0/mqdefault.jpg',
'https://i.ytimg.com/vi/Z0ZUwh8GOo0/hqdefault.jpg',
'https://i.ytimg.com/vi/Z0ZUwh8GOo0/sddefault.jpg' ],
Rh9a1ICbIJE: [
'https://i.ytimg.com/vi/Rh9a1ICbIJE/default.jpg',
'https://i.ytimg.com/vi/Rh9a1ICbIJE/mqdefault.jpg',
'https://i.ytimg.com/vi/Rh9a1ICbIJE/hqdefault.jpg',
'https://i.ytimg.com/vi/Rh9a1ICbIJE/sddefault.jpg',
'https://i.ytimg.com/vi/Rh9a1ICbIJE/maxresdefault.jpg' ]
]
If onlyHighestRes and getResolutions are set to true in config
[
Z0ZUwh8GOo0: {
url: 'https://i.ytimg.com/vi/Z0ZUwh8GOo0/sddefault.jpg',
width: 640,
height: 480 },
Rh9a1ICbIJE: {
url: 'https://i.ytimg.com/vi/Rh9a1ICbIJE/maxresdefault.jpg',
width: 1280,
height: 720 }
]
1.0.1
MIT
FAQs
Requests Youtube API for all thumbnails related to Youtube Video IDs
We found that youtube-api-thumbnails demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.