Am I right in saying they need to be able to run JS code from YouTube to be able to get the download URL at this point? Deliberate obfuscation I'm guessing? I guess Deno makes the code fairly safe to execute and I guess the chances of YouTube daring to download spyware onto your machine is minimal :-)