
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@maxbbrown/shello
Advanced tools
An AI-powered terminal assistant that transforms natural language into shell commands. Built for developers who want to work faster and smarter in the terminal.
curl -fsSL https://raw.githubusercontent.com/your-username/cli-assistant/main/install.sh | bash
git clone https://github.com/your-username/cli-assistant.git
cd cli-assistant
npm install
npm run build
npm link
npm install -g cli-assistant
Set your OpenAI API key:
cli-ai config set-api-key <your-openai-api-key>
Start interactive mode:
cli-ai
Or use one-off commands:
cli-ai ask "list all files modified in the last 24 hours"
$ cli-ai
🤖 CLI Assistant
Your AI-powered terminal assistant
You: show me all git branches
AI: git branch -a
Execute "git branch -a"? (y/N) y
# File operations
cli-ai ask "find all JavaScript files larger than 1MB"
cli-ai ask "compress all images in the current directory"
# Git operations
cli-ai ask "create a new branch called feature-auth"
cli-ai ask "show me what changed in the last commit"
# Docker operations
cli-ai ask "list all running containers with their ports"
cli-ai ask "build and run the app in development mode"
# System operations
cli-ai ask "show me the top 10 processes using the most memory"
cli-ai ask "find which process is using port 3000"
# See what command would run without executing
cli-ai ask "delete all node_modules folders" --dry-run
cli-ai config show
# Set API key
cli-ai config set-api-key <key>
# Enable/disable dry run by default
cli-ai config set dry-run true
# Set default model
cli-ai config set model gpt-4
# Set safety level (strict/moderate/permissive)
cli-ai config set safety-level strict
# List recent sessions
cli-ai session list
# Clean up old sessions (older than 30 days)
cli-ai session cleanup --days 30
The CLI Assistant supports plugins for enhanced functionality:
src/
├── core/ # Core functionality
│ ├── ai-service.ts # LLM integration
│ ├── context.ts # Context awareness
│ ├── executor.ts # Command execution
│ ├── session-manager.ts # Session persistence
│ └── config.ts # Configuration management
├── plugins/ # Plugin system
│ ├── base-plugin.ts # Plugin base class
│ ├── docker-plugin.ts # Docker integration
│ ├── git-plugin.ts # Git integration
│ └── plugin-manager.ts # Plugin management
├── types/ # TypeScript definitions
└── cli.ts # CLI interface
# Install dependencies
npm install
# Run in development mode
npm run dev
# Build for production
npm run build
# Run tests
npm test
# Lint code
npm run lint
import { BasePlugin } from './base-plugin';
import { CommandContext, AIResponse } from '../types';
export class MyPlugin extends BasePlugin {
name = 'my-plugin';
version = '1.0.0';
description = 'My custom plugin';
async suggestCommands(userInput: string, context: CommandContext): Promise<AIResponse[]> {
// Your plugin logic here
return [];
}
}
We welcome contributions! Please see our Contributing Guide for details.
MIT License - see LICENSE file for details.
Made with ❤️ for developers who love the terminal
FAQs
Your AI shell companion - natural language to shell commands
We found that @maxbbrown/shello demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.