
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@atools/cf-core
Advanced tools
CF Framework 的核心功能包,提供基础命令系统和钩子系统。
npm install @atools/cf-core
# 或
yarn add @atools/cf-core
# 或
pnpm add @atools/cf-core
const { BaseCommand } = require('@atools/cf-core');
class MyCommand extends BaseCommand {
constructor(config) {
super(config);
}
// 配置命令选项
init(commander) {
commander
.option('-n, --name <name>', '选项描述');
}
// 实现命令逻辑
async do() {
const { name } = this.config;
// 使用 this.context 访问上下文
const { env, cwd } = this.context;
// 实现你的命令逻辑
}
}
const { bootstrap } = require('@atools/cf-core');
// 注册钩子
bootstrap.hooks.tap('will-inject', async (next) => {
// 在命令注入前执行
console.log('will-inject');
await next();
});
// 启动应用
bootstrap({
root: 'path/to/commands', // 命令目录
version: '1.0.0' // 版本号
});
基础命令类,提供以下功能:
config - 命令配置对象context - 命令上下文,包含:
env - 环境变量cwd - 当前工作目录helper - 辅助工具对象constructor(config) - 构造函数,接收配置对象setup() - 初始化命令上下文init(commander) - 配置命令选项do() - 实现命令逻辑action() - 执行命令(内部使用)启动函数,用于初始化 CLI 应用:
bootstrap({
root: string, // 命令目录路径
version: string // CLI 版本号
});
will-inject - 在命令注入前执行will-parse - 在命令解析前执行欢迎提交 issue 和 PR!
MIT
FAQs
Core functionality for CF - A guided, interactive CLI framework for Node.js
We found that @atools/cf-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.