
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
A modular downloading tool. Includes code for a small collection of streaming services (does not come with accounts or tokens).
Lucida is made to use few NodeJS dependencies and no system dependencies (...besides ffmpeg)
import Lucida from 'lucida'
import Tidal from 'lucida/streamers/tidal/main.js'
import Qobuz from 'lucida/streamers/qobuz/main.js'
import Spotify from 'lucida/streamers/spotify/main.js'
const lucida = new Lucida({
modules: {
tidal: new Tidal({
// tokens
}),
qobuz: new Qobuz({
// tokens
}),
spotify: new Spotify({
// options
})
// Any other modules
},
logins: {
qobuz: {
username: '',
password: ''
},
spotify: {
username: '',
password: ''
}
}
})
// only needed if using modules which use the logins configuration rather than tokens
await lucida.login()
const track = await lucida.getByUrl('https://tidal.com/browse/track/255207223')
await fs.promises.writeFile('test.flac', (await track.getStream()).stream)
// only needed for modules which create persistent connections (of the built-in modules, this is just Spotify)
await lucida.disconnect()
For using a specific module, you can just use the functions built into the Streamer interface.
Default export is a class which implements the Streamer interface:
interface Streamer {
hostnames: string[]
search(query: string, limit: number): Promise<SearchResults>
getByUrl(url: string): Promise<GetByUrlResponse>
}
They can optionally include a login function in this class which takes a username and password (if supported):
async login(username: string, password: string): void
Options for the app, including tokens (if supported by the given app), are passed to the class's constructor:
new StreamerApp({ token: 'secret!' })
The classes can also include their own custom functions. Any function used by Lucida's app-agnostic code should be defined in the Streamer interface for compatibility across multiple apps.
Functions for parsing the app's API into the types defined in src/types.ts.
Constants used by main.ts. Secrets should not be defined here (or anywhere else in the project).
Wraps all the Streamers using a module system. See the usage section.
Types used across the project. The purpose of many of these is to make sure all apps' functions return the same types so the rest of the logic can work across all apps the same.
Lucida is partially inspired by OrpheusDL, a Python program for music archival which can be used similarly to Lucida. Some scripts inside Lucida are modeled after OrpheusDL modules.
Copyright hazycora. Under the Opinionated Queer License.
FAQs
A modular music downloader tool
The npm package lucida receives a total of 25 weekly downloads. As such, lucida popularity was classified as not popular.
We found that lucida demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.