
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@captain_z/lyra
Advanced tools
Lyra is a CLI toolkit for Markdown-first content production. It helps you generate weekly content, assemble article prompts, and keep frontmatter metadata (especially tags) clean and consistent.
Package name: @captain_z/lyra
CLI command: lyra
weekly and more)lyra article / lyra promptlyra schedulelyra check-imageslyra check-metadata# Global install
npm install -g @captain_z/lyra
# Local install
npm install @captain_z/lyra
# 1) Initialize config
lyra init
# 2) List available templates
lyra list
# 3) Preview generation (no file output)
lyra weekly --dry-run
# 4) Generate content
lyra weekly
| Command | Alias | Description |
|---|---|---|
lyra | - | Launch interactive mode |
lyra <template> | - | Quick generation by template |
lyra create [template] | lyra c | Explicit generation command |
lyra list | lyra ls | List registered templates |
lyra init | - | Initialize config file |
lyra config | - | Show/validate config |
lyra schedule | lyra sched | Run scheduler |
lyra check-images | lyra check-img | Check image hosts against allowlist |
lyra check-metadata | lyra check-meta | Validate/organize frontmatter and tags |
lyra article | lyra a | Build article prompt |
lyra prompt | lyra p | Backward-compatible alias of article |
lyra check-metadata supports both directory and single-file input, with automatic dedupe and optional AI-assisted tag generation.
# Check directory only (no write)
lyra check-metadata --path ../your-notes-repo
# Normalize tags (dedupe/trim/split delimiters)
lyra check-metadata --path ../your-notes-repo --fix-tags
# Normalize a single file
lyra check-metadata --path ./Input/Notes/today.md --fix-tags
# Normalize + AI enrich tags based on content
lyra check-metadata --path ../your-notes-repo --fix-tags --ai-tags --provider openai
Common options:
--path <path>: directory or single Markdown file--fix-tags: normalize tags (dedupe, trim, delimiter cleanup)--ai-tags: generate/enrich tags from title and body content--max-tags <n>: max tags per file (default 8)--min-tags <n>: min tags per file (default 1)--dry-run: preview only, no writeProvider notes:
AI_API_KEY from .envAI_BASE_URL to switch providers (OpenAI-compatible), e.g. OpenRouter or LiteLLMAI_MODEL controls the model nameExample .env:
AI_API_KEY=your_key
AI_BASE_URL=https://openrouter.ai/api/v1
AI_MODEL=openai/gpt-4o-mini
Example LiteLLM:
AI_API_KEY=your_key
AI_BASE_URL=http://localhost:4000/v1
AI_MODEL=gpt-4o-mini
Unsplash (cover fallback):
UNSPLASH_ACCESS_KEY=your_unsplash_key
Reference links:
{
"templates": {
"weekly": {
"export": {
"referenceLinks": { "enabled": true }
}
}
}
}
Lyra searches upward from current directory for these config files:
.lyrarc.lyrarc.json.lyrarc.yaml.lyrarc.yml.lyrarc.js.lyrarc.cjs.lyrarc.mjslyra.config.jsonlyra.config.jslyra.config.cjslyra.config.mjs{
"global": {
"logLevel": "info",
"defaultTemplate": "weekly"
},
"templates": {
"weekly": {
"enabled": true,
"template": {
"path": "./templates/weekly.hbs"
},
"sources": {
"articles": "./articles",
"tools": "./tools",
"notes": "./notes"
},
"output": {
"path": "./output",
"filename": "Weekly-{{issueNumber}}.md"
},
"content": {
"articles": { "topN": 10, "minRating": 0 },
"tools": { "perCategory": 3 },
"notes": { "groupBy": "none" }
}
}
}
}
Lyra follows semantic versioning (MAJOR.MINOR.PATCH):
MAJOR: breaking changesMINOR: backward-compatible featuresPATCH: backward-compatible fixesFor frequent publishing, increment at least PATCH for every release.
wechat.publish.json / zhihu.publish.json files.lyrarc.json)WECHAT_ACCESS_TOKEN, AI_API_KEY) should live in .env (auto-loaded). Use --env for custom env files. See .env.example.{
"lyraConfig": "./.lyrarc.json",
"title": "Default Title",
"author": "Lyra",
"digest": "Default digest",
"thumb_image_path": "./Output/Z° North/Publish/default-cover.png",
"cover_source_order": ["ai", "unsplash", "placeholder"],
"articles": [
{
"title": "Weekly #12",
"module": "weekly",
"contentFile": "./Output/Z° North/Z°N Weekly/drafts/2026-03-16-weekly.html"
},
{
"title": "Life Notes",
"contentFile": "./Output/Z° North/Z°N 生活志/drafts/2026-03-16-life.html"
}
]
}
Publish command:
lyra publish --config ./wechat.publish.json
npm publish fails at prepublishOnlyIf publish fails during npm run build with EPERM on dist, rebuild from clean state and check permissions:
rm -rf dist
npm run build
lyra init
lyra weekly --dry-run --verbose
MIT
FAQs
Universal content generation framework with plugin-based architecture
We found that @captain_z/lyra demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.