
Security News
Cline CLI npm Package Compromised via Suspected Cache Poisoning Attack
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.
A powerful AI-powered CLI tool that executes predefined commands with a single shot. Built on top of assistant-code, 1shot provides a collection of ready-to-use AI assistants for common development tasks.
npm install -g 1shot
You need an Anthropic API key to use 1shot:
export ANTHROPIC_API_KEY=your-api-key
# or
export ASSISTANT_CODE_API_KEY=your-api-key
Get your API key from: https://claude.ai/settings/keys
# Run a specific command
1shot <command-name>
# Run a command with custom prompt
1shot <command-name> "your custom request"
# Interactive command selector
1shot commands
# Create a README for your project
1shot readme
# Find and fix bugs in your codebase
1shot bug
# Create a comprehensive PRD with best practices
1shot prd
# Upgrade your React version
1shot upgrade-react
# Use custom prompt with any command
1shot readme "Create a detailed README with installation, usage, and API sections"
# Interactive mode - browse and select commands
1shot commands
1shot checks your git status before executing commands and will warn you if:
You can choose to continue anyway or cancel to commit your changes first.
During command execution, you can:
1shot/
├── src/
│ ├── index.ts # Main CLI entry point
│ ├── registry.ts # Command registry
│ └── components/ # React components (if any)
├── dist/ # Compiled output
├── package.json
├── build.mts # Build configuration
└── README.md
# Install dependencies
npm install
# Build the project
npm run build
# Run in watch mode
npm run dev
To add a new command, edit src/registry.ts:
export const registry: Record<string, RegistryEntry> = {
"your-command": {
systemPrompt: "System prompt for the AI assistant",
prompt: "🎯 Default user prompt",
},
// ... other commands
};
Key points for new commands:
@assistant-ui/react - UI components for assistant interfacesassistant-code - Core AI assistant functionalityink - React renderer for CLI appscross-spawn - Cross-platform command executionvite - Build toolgit checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)If you see "No API key found", ensure you've set:
export ANTHROPIC_API_KEY=your-api-key
If 1shot command is not found after installation:
sudo (on Unix systems)npx 1shot as an alternativeIf you encounter build errors:
node_modules and reinstallMIT License - see LICENSE file for details
Built with ❤️ using:
FAQs
1shot CLI
The npm package 1shot receives a total of 11 weekly downloads. As such, 1shot popularity was classified as not popular.
We found that 1shot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.

Product
Socket now supports PHP with full Composer and Packagist integration, enabling developers to search packages, generate SBOMs, and protect their PHP dependencies from supply chain threats.