
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@contractkit/cli
Advanced tools
The contractkit binary — orchestrates parsing, plugin loading, incremental caching, and prettier formatting for .ck contract files.
pnpm add -D @contractkit/cli
This package only handles file discovery, configuration, caching, and dispatch to plugins. All code generation lives in plugins that you list under "plugins" in contractkit.config.json.
contractkit [options]
Options:
-c, --config <path> Path to config file (default: searches for contractkit.config.json)
-w, --watch Watch for changes and recompile
--force Skip incremental cache, recompile all
-h, --help Show help
The CLI walks upward from the current directory looking for contractkit.config.json if -c is not provided.
Create contractkit.config.json at your project root:
{
"rootDir": ".",
"cache": true,
"prettier": true,
"patterns": ["contracts/**/*.ck"],
"plugins": {
"@contractkit/plugin-typescript": {
"server": {
"baseDir": "apps/api/",
"zod": true,
"output": {
"routes": "src/routes/{filename}.router.ts",
"types": "src/modules/{area}/types/{filename}.ts"
},
"servicePathTemplate": "#modules/{module}/{module}.service.js"
}
},
"@contractkit/plugin-openapi": {
"baseDir": "docs/api/",
"output": "openapi.yaml",
"info": { "title": "My API", "version": "1.0.0" }
}
}
}
| Field | Type | Description |
|---|---|---|
rootDir | string | Base directory for resolving relative paths. Supports ~ for $HOME. Default: . |
cache | boolean | string | Enable incremental compilation cache. Pass a string to use a custom cache filename. Default: false. |
prettier | boolean | Format generated TypeScript files with the project's local prettier. Default: false. |
patterns | string[] | Glob patterns for .ck files to compile, relative to rootDir. |
plugins | object | Map of plugin package name → options. The CLI loads each key as a plugin and passes its value to the plugin as ctx.options. Any keys: { ... } entries inside a plugin's options are also merged into a workspace-wide fallback map for {{var}} substitution in .ck files (file-local options.keys still wins). The values themselves can reference the built-ins {{rootDir}} and {{configDir}} for the resolved config paths. |
When "cache": true, the CLI hashes each .ck file plus the resolved plugin config and skips files whose inputs haven't changed since the last run. Caches live under .contractkit/cache/ (override the directory by passing a string for cache): build.json for build hashes, and http/<sha256(url)> for any fetched plugin extension HTTP responses. Use --force to bypass everything.
The build cache is stamped with a fingerprint of the @contractkit/cli, @contractkit/core, and every loaded plugin's package version. When any of those versions changes, the fingerprint no longer matches and the entire cache is dropped on the next run — a pnpm update of any codegen-affecting package forces a clean rebuild instead of silently serving stale generated files.
At the end of each run, the CLI also deletes any generated file that a previous run claimed but no plugin claims this run (because the plugin was removed from contractkit.config.json, renamed, or its output set shrank). Cleanup is best-effort: stale paths or permission failures log nothing and never fail the build, and the CLI never deletes a file emitted by another plugin in the same run.
Each plugin is its own npm package, listed under "plugins":
| Package | Generates |
|---|---|
@contractkit/plugin-typescript | Koa routers, TypeScript SDK clients, Zod schemas, plain TS types |
@contractkit/plugin-openapi | OpenAPI 3.0 YAML |
@contractkit/plugin-markdown | Markdown API reference |
@contractkit/plugin-bruno | Bruno REST collection |
@contractkit/plugin-python | Python SDK client (Pydantic v2 + httpx) |
For writing your own plugin, see @contractkit/core.
Plugins can register additional CLI subcommands via the command hook. For example, @contractkit/openapi-to-ck registers contractkit openapi-to-ck for converting an OpenAPI YAML file back into .ck files.
contractkit openapi-to-ck --input openapi.yaml --output contracts/
Run contractkit --help to list registered subcommands.
FAQs
Compiler for .ck files
We found that @contractkit/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.