
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@aurorajs.dev/catalyst-cli
Advanced tools
A new CLI generated with oclif
$ npm install -g @aurorajs.dev/catalyst-cli
$ catalyst COMMAND
running command...
$ catalyst (--version)
@aurorajs.dev/catalyst-cli/1.0.0 darwin-arm64 node-v24.14.0
$ catalyst --help [COMMAND]
USAGE
$ catalyst COMMAND
...
catalyst add - Add an Aurora package to an existing project.catalyst ai - AI provider configuration sync (CLAUDE.md, AGENTS.md, skills symlinks)catalyst autocomplete - Display autocomplete installation instructions.catalyst deploy - Deploy Aurora projectscatalyst env - Encrypt/decrypt environment files with SOPScatalyst generate - Generate a module's source code from its YAML definition.catalyst help - Display help for catalyst.catalyst keys - Generate RSA private key and public key (defaults to ./backend/.keys)catalyst new - Create a new Aurora monorepo project.catalyst origin - Manage .origin files emitted by catalyst generatecatalyst pipeline - Generate a deploy workflow from templates (interactive).catalyst plugins - List installed plugins.catalyst provision - Provision Aurora project infrastructure (DNS + Hosting + CI/CD)catalyst sheets - Bidirectional sync between Aurora YAML schemas and Google SheetsBidirectional sync between Aurora YAML schemas and Google Sheets. Each bounded context maps to a spreadsheet where module schemas can be collaboratively edited.
Create a service account in Google Cloud Console with Google Sheets API enabled, then base64-encode the JSON key:
base64 -i service-account.json
Add it to your .env:
GOOGLE_SERVICE_ACCOUNT=eyJ0eXBlIjoic2VydmljZV9hY2NvdW50Ii...
Share each spreadsheet with the service account email (with Editor access).
Add a sheets section to aurora.yaml:
sheets:
bounded_contexts:
iam:
spreadsheet_id: 'YOUR_SPREADSHEET_ID'
description: 'Identity and Access Management'
common:
spreadsheet_id: 'YOUR_SPREADSHEET_ID'
description: 'Common module schemas'
YAML schemas are expected in ./cliter/{bounded_context}/*.aurora.yaml.
# List configured bounded contexts
aurora sheets list
# Validate connection to a spreadsheet
aurora sheets validate --bc iam
# Push YAML schemas to Google Sheets
aurora sheets push --bc iam
aurora sheets push --all
aurora sheets push --all --dry-run
# Pull from Google Sheets to YAML files
aurora sheets pull --bc iam
aurora sheets pull --all
aurora sheets pull --all --no-backup
# Show differences between YAML and Sheets
aurora sheets diff --bc iam
aurora sheets diff --all --summary
Without --bc or --all, commands prompt interactively for the bounded context.
Trigger CI/CD pipelines by pushing source branches to environments/{env}. The GitHub Actions workflow is configured to run on push to environments/**.
Each environment in aurora.yaml has an optional source field (defaults to main) that specifies which branch to push:
environments:
dev:
source: main # pushes main → environments/dev
prod:
source: qa # promotes qa → environments/prod
# Deploy all environments
aurora deploy
# Deploy only dev
aurora deploy --env dev
# Dry run — show what would be pushed without executing
aurora deploy --dry-run
# Custom config path
aurora deploy --env prod -c ../aurora.yaml
Internally, the command runs git push origin {source}:environments/{env} for each resolved environment.
Create a .env file in your project root (next to aurora.yaml):
IONOS_API_KEY=prefix.secret
PLESK_API_KEY=your-plesk-api-key
PLESK_HOST=plesk.yourserver.com
PLESK_SSH_KEY=~/.ssh/plesk.yourserver.com
PLESK_SSH_USER=root
# Global passwords (used as fallback for all environments)
FTP_PASSWORD=your-ftp-password
DB_PASSWORD=your-db-password
# Per-environment passwords (take priority over global)
# DEV_FTP_PASSWORD=dev-ftp-pass
# PROD_FTP_PASSWORD=prod-ftp-pass
# DEV_DB_PASSWORD=dev-db-pass
# PROD_DB_PASSWORD=prod-db-pass
The deploy key installation on the Plesk server requires SSH access. If SSH is not available, the CLI will show a warning with the public key to install manually — it does not block the deployment.
To set up SSH access, generate a key named after the server and copy it:
# 1. Generate key (one time per machine)
ssh-keygen -t ed25519 -C "aurora-cli@PLESK_HOST" -f ~/.ssh/PLESK_HOST -N ""
# 2. Copy to server (will ask for root password)
ssh-copy-id -i ~/.ssh/PLESK_HOST.pub root@PLESK_HOST
# 3. Verify
ssh -i ~/.ssh/PLESK_HOST root@PLESK_HOST "echo OK"
Replace PLESK_HOST with your actual server hostname (e.g., s14.beopen.cloud).
Then add the key path to your .env:
PLESK_SSH_KEY=~/.ssh/PLESK_HOST
Copy aurora.example.yaml to aurora.yaml in your project and fill in your values.
# Provision all environments (passwords from .env)
aurora provision
# Provision only dev
aurora provision --env dev
# Provision only prod backend
aurora provision --env prod --target back
# Provision only frontend (all environments)
aurora provision --target front
# Skip DNS and CI/CD (applies to all plans)
aurora provision --skip-dns --skip-cicd
# Pass passwords inline (overrides .env)
aurora provision --ftp-password s3cret --db-password dbpass
GitHub secrets and variables are prefixed with ENV_TARGET_ (e.g., DEV_BACK_SSH_PRIVATE_KEY, PROD_FRONT_SERVER_HOST).
FAQs
A CLI tool to manage Aurora Catalyst projects
The npm package @aurorajs.dev/catalyst-cli receives a total of 5 weekly downloads. As such, @aurorajs.dev/catalyst-cli popularity was classified as not popular.
We found that @aurorajs.dev/catalyst-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.