See the full list of npm packages compromised in the "SHA1-Hulud npm supply chain incident – Nov 2025" [View compromised packages].
ytdl-utils-cli vulnerabilities
Download youtube music or playlist in mp3 format. If the playlist is in private, it won’t work. But it will fallback to the single video of the link. If the URL contains the param "list" it will download the entire playlist.