
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
A powerful AI-powered CLI tool that executes predefined commands with a single shot. Built on top of assistant-code, 1shot provides a collection of ready-to-use AI assistants for common development tasks.
npm install -g 1shot
You need an Anthropic API key to use 1shot:
export ANTHROPIC_API_KEY=your-api-key
# or
export ASSISTANT_CODE_API_KEY=your-api-key
Get your API key from: https://claude.ai/settings/keys
# Run a specific command
1shot <command-name>
# Run a command with custom prompt
1shot <command-name> "your custom request"
# Interactive command selector
1shot commands
# Create a README for your project
1shot readme
# Find and fix bugs in your codebase
1shot bug
# Create a comprehensive PRD with best practices
1shot prd
# Use custom prompt with any command
1shot prd "Add user personas and an API section."
# Interactive mode - browse and select commands
1shot commands
1shot checks your git status before executing commands and will warn you if:
You can choose to continue anyway or cancel to commit your changes first.
During command execution, you can:
1shot/
├── src/
│ ├── index.ts # Main CLI entry point
│ ├── registry.ts # Command registry
│ └── components/ # React components (if any)
├── dist/ # Compiled output
├── package.json
├── build.mts # Build configuration
└── README.md
# Install dependencies
npm install
# Build the project
npm run build
# Run in watch mode
npm run dev
To add a new command, edit src/registry.ts:
export const registry: Record<string, RegistryEntry> = {
"your-command": {
systemPrompt: "System prompt for the AI assistant",
prompt: "🎯 Default user prompt",
},
// ... other commands
};
Key points for new commands:
@assistant-ui/react - UI components for assistant interfacesassistant-code - Core AI assistant functionalityink - React renderer for CLI appscross-spawn - Cross-platform command executionvite - Build toolgit checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)If you see "No API key found", ensure you've set:
export ANTHROPIC_API_KEY=your-api-key
If 1shot command is not found after installation:
sudo (on Unix systems)npx 1shot as an alternativeIf you encounter build errors:
node_modules and reinstallMIT License - see LICENSE file for details
Built with ❤️ using:
FAQs
1shot CLI
The npm package 1shot receives a total of 11 weekly downloads. As such, 1shot popularity was classified as not popular.
We found that 1shot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.