
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@buzzr/dfs-cli
Advanced tools
Command-line wrapper around @buzzr/dfs-engine — grade a DFS entry from JSON fixtures without writing code.
Grade a DFS pick'em entry from two JSON files — no code required. A command-line wrapper around @buzzr/dfs-engine, the settlement engine that grades PrizePicks/Underdog-style entries with book-accurate payout math and a full audit trail.
npm install -g @buzzr/dfs-cli
Create entry.json (the slip you want to grade):
{
"entryId": "entry-001",
"bookId": "prizepicks",
"playTypeId": "power",
"stake": 10,
"displayedMultiplier": 3,
"legs": [
{
"legId": "leg-1",
"playerName": "Jayson Tatum",
"playerId": "athlete-a",
"league": "NBA",
"propType": "Points",
"line": 26.5,
"direction": "over",
"actual": null,
"status": "pending",
"gameDate": "2026-05-07T00:00:00.000Z"
}
]
}
And gamelogs.json (what the players actually did, keyed by legId):
{
"leg-1": [
{
"date": "2026-05-07T00:00:00.000Z",
"minutes": "38:00",
"points": "31",
"rebounds": "8",
"assists": "5",
"steals": "1",
"blocks": "0",
"turnovers": "2",
"threeP": "4"
}
]
}
Then grade it:
dfs-grade entry.json --gamelogs gamelogs.json
The full DfsSettlementResult prints to stdout as JSON — status, payout split, per-leg decisions with provider provenance, a validation report, and an audit trail:
{
"entryId": "entry-001",
"bookId": "prizepicks",
"status": "won",
"effectiveMultiplier": 3,
"payout": { "total": 30, "withdrawable": 30, "bonus": 0 },
"legs": [{ "legId": "leg-1", "status": "won", "actual": 31, "...": "..." }],
"auditTrail": [{ "code": "settlement.won", "...": "..." }]
}
Exit code is 0 on success and 1 on any error (bad JSON, invalid entry, unknown book policy), so it drops straight into shell scripts and CI pipelines.
The same grading path is exported as plain async functions:
import { runGrade, runGradeFromFiles } from '@buzzr/dfs-cli';
// From in-memory objects
const result = await runGrade({
entry, // DfsEntryInput
gameLogsByLegId: { 'leg-1': [gameLogRow] },
});
// Or straight from files
const fromFiles = await runGradeFromFiles({
entryPath: './entry.json',
gameLogsPath: './gamelogs.json',
});
| Export | Purpose |
|---|---|
dfs-grade (bin) | Grade an entry JSON against a gamelogs JSON, print settlement |
runGrade() | Grade an in-memory DfsEntryInput against a legId → gamelog[] map |
runGradeFromFiles() | Same, reading both inputs from file paths |
createDfsEngine et al | Re-exported engine primitives for convenience |
| You want to… | Reach for |
|---|---|
| Grade entries from the shell, CI, or a cron job | this package |
| Grade entries inside a TypeScript/JavaScript app | @buzzr/dfs-engine |
| Render results in a UI | @buzzr/dfs-react |
| Build fixtures for your own tests | @buzzr/dfs-testkit |
| Verify your integration grades identically to Buzzr | @buzzr/dfs-engine-test-vectors |
MIT
FAQs
Command-line wrapper around @buzzr/dfs-engine — grade a DFS entry from JSON fixtures without writing code.
The npm package @buzzr/dfs-cli receives a total of 3 weekly downloads. As such, @buzzr/dfs-cli popularity was classified as not popular.
We found that @buzzr/dfs-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.