
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
spotify
Advanced tools
An API library for the spotify client and the Spotify Web API written in Python.
Spotify.py is an asyncronous API library for Spotify. While maintaining an
emphasis on being purely asyncronous the library provides syncronous
functionality with the spotify.sync module.
import spotify.sync as spotify # Nothing requires async/await now!
To install the library simply clone it and run pip.
git clone https://github.com/mental32/spotify.pypip3 install -U .or use pypi
pip3 install -U spotify (latest stable)pip3 install -U git+https://github.com/mental32/spotify.py#egg=spotify (nightly)import sys
import getpass
import spotify
async def main():
playlist_uri = input("playlist_uri: ")
client_id = input("client_id: ")
secret = getpass.getpass("application secret: ")
token = getpass.getpass("user token: ")
async with spotify.Client(client_id, secret) as client:
user = await spotify.User.from_token(client, token)
async for playlist in user:
if playlist.uri == playlist_uri:
return await playlist.sort(reverse=True, key=(lambda track: track.popularity))
print('No playlists were found!', file=sys.stderr)
if __name__ == '__main__':
client.loop.run_until_complete(main())
import spotify
from spotify.oauth import get_required_scopes
# In order to call this method sucessfully the "user-modify-playback-state" scope is required.
print(get_required_scopes(spotify.Player.play)) # => ["user-modify-playback-state"]
# Some methods have no oauth scope requirements, so `None` will be returned instead.
print(get_required_scopes(spotify.Playlist.get_tracks)) # => None
import string
import random
from typing import Tuple, Dict
import flask
import spotify.sync as spotify
SPOTIFY_CLIENT = spotify.Client('SPOTIFY_CLIENT_ID', 'SPOTIFY_CLIENT_SECRET')
APP = flask.Flask(__name__)
APP.config.from_mapping({'spotify_client': SPOTIFY_CLIENT})
REDIRECT_URI: str = 'http://localhost:8888/spotify/callback'
OAUTH2_SCOPES: Tuple[str] = ('user-modify-playback-state', 'user-read-currently-playing', 'user-read-playback-state')
OAUTH2: spotify.OAuth2 = spotify.OAuth2(SPOTIFY_CLIENT.id, REDIRECT_URI, scopes=OAUTH2_SCOPES)
SPOTIFY_USERS: Dict[str, spotify.User] = {}
@APP.route('/spotify/callback')
def spotify_callback():
try:
code = flask.request.args['code']
except KeyError:
return flask.redirect('/spotify/failed')
else:
key = ''.join(random.choice(string.ascii_uppercase) for _ in range(16))
SPOTIFY_USERS[key] = spotify.User.from_code(
SPOTIFY_CLIENT,
code,
redirect_uri=REDIRECT_URI,
refresh=True
)
flask.session['spotify_user_id'] = key
return flask.redirect('/')
@APP.route('/spotify/failed')
def spotify_failed():
flask.session.pop('spotify_user_id', None)
return 'Failed to authenticate with Spotify.'
@APP.route('/')
@APP.route('/index')
def index():
try:
return repr(SPOTIFY_USERS[flask.session['spotify_user_id']])
except KeyError:
return flask.redirect(OAUTH2.url)
if __name__ == '__main__':
APP.run('127.0.0.1', port=8888, debug=False)
FAQs
spotify.py is an asynchronous API wrapper for Spotify written in Python.
We found that spotify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.