
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
yt-dl-playlist
Advanced tools
This module let you to programatic download the audio files of a video playlist on YouTube in MP3 format. It exposes API to download also single audio.
The name of this module is due the npm policy, call it youtube-download-playlist.
⚠ You must use this module/cli respecting the YouTube's Copyright Policies.
npm install yt-dl-playlist
Run yd --help to see all the options!!
The cli is very simple and quick-and-dirty:
# NPM Global
npm install yt-dl-playlist -g
yd <video_id or playlist_id>
# NPX
npx yt-dl-playlist <video_id or playlist_id> [flags]
Examples:
# Download playlist
yd PLAv2aQ9JgGbVcUtDpuiTB9WgaMljCUpa_ -p
# Download audio
yd 2bexTB7xq_U
# View info video
yd --info 2bexTB7xq_U
This program needs ffmpeg.
It is a free program that elaborate video and audio stream.
It can be download also in the portable .zip without installation!
To config the ffmpeg path you can run the script in a cmd shell like this:
yd ZIyyj2FrVI0 -F /ffmpeg/bin
Or more simply run the yd command from the directory where ffmpeg is saved:
cd download/ffmpeg/bin
yd ZIyyj2FrVI0
You can use this lib as a module also!
const DownloadYTFile = require('yt-dl-playlist')
const downloader = new DownloadYTFile({
outputPath: process.cwd(),
ffmpegPath: './ffmpeg/bin/ffmpeg.exe',
maxParallelDownload: 10,
fileNameGenerator: (videoTitle) => {
return 'a-new-file-name.mp3'
}
})
downloader.on('video-info', (fileInfo, video) => {
console.log({ fileInfo, video })
})
downloader.on('video-setting', (fileInfo, settings) => {
console.log({ fileInfo, settings })
})
downloader.on('start', (fileInfo) => console.log(fileInfo))
downloader.on('progress', (fileInfo) => console.log(fileInfo))
downloader.on('complete', (fileInfo) => console.log(fileInfo))
downloader.on('error', (fileInfo) => console.log(fileInfo.error))
downloader.download(id, inputFileName = null) : Promise<object>
downloader.downloadPlaylist(playlistId) : Promise<Array>
downloader.getPlaylistInfo(playlistId) : Promise<object>
downloader.getVideoInfo(videoId) : Promise<object>
Copyright MIT.
FAQs
Download audio from YouTube
We found that yt-dl-playlist demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.