
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@dscodotco/theme-cli
Advanced tools
A command-line interface for working with e-commerce themes, starting with Shopify themes. This tool is designed to work in browser environments like webcontainers.io.
This package is designed to be used with npx without installation, but you can install it globally if you prefer:
npm install -g @dscodotco/theme-cli
# Using npx (recommended)
npx @dscodotco/theme-cli shopify theme init
# Or with a custom name
npx @dscodotco/theme-cli shopify theme init --name my-custom-theme
# Specify an output directory
npx @dscodotco/theme-cli shopify theme init --output-dir /path/to/projects
# Force overwrite if directory exists
npx @dscodotco/theme-cli shopify theme init --force
# If installed globally
theme-cli shopify theme init
--name, -n: Specify a custom name for the theme directory (default: "my-theme")--force, -f: Overwrite the directory if it already exists--output-dir, -o: Directory where the theme will be created (defaults to current directory)Run a local development server that renders Shopify Liquid templates using Shopify's own rendering engine:
# Using npx
npx @dscodotco/theme-cli shopify theme dev \
--store your-store \
--api-key your-api-key \
--password your-admin-api-password \
--theme-id 123456789
# Specify theme directory and port
npx @dscodotco/theme-cli shopify theme dev \
--store your-store \
--api-key your-api-key \
--password your-admin-api-password \
--theme-id 123456789 \
--theme-dir ./my-theme \
--port 4000
--store, -s: Your Shopify store name without .myshopify.com (required)--api-key, -k: Your Shopify Admin API key (required)--password, -p: Your Shopify Admin API password/token (required)--theme-id, -t: ID of the theme to use for development (required)--theme-dir, -d: Theme directory path (defaults to current directory)--port: Port for the preview server (defaults to 3000)You can also use the package programmatically in your JavaScript/TypeScript projects:
import { initShopifyTheme } from '@dscodotco/theme-cli';
// Initialize a theme with custom options
await initShopifyTheme({
name: 'my-store-theme',
outputDir: './projects',
force: true
});
Clone the repository:
git clone https://github.com/yourusername/theme-cli.git
cd theme-cli
Install dependencies:
npm install
Build the project:
npm run build
Run locally:
npm start -- shopify theme init
theme-cli/
├── src/ # Source code
│ ├── commands/ # Command implementations
│ │ └── shopify/ # Shopify specific commands
│ ├── utils/ # Utility functions
│ └── types/ # TypeScript type definitions
├── dist/ # Compiled output
└── ...
This tool is specifically designed to work in webcontainers.io environments. It downloads theme files directly from URLs rather than using Git, making it ideal for browser-based development environments.
MIT © dsco.co
Made with ❤️ by DSCO
A command-line interface for working with Shopify themes, featuring a local development server with live preview capabilities.
# Install globally
npm install -g @dscodotco/theme-cli
# Or use with npx
npx @dscodotco/theme-cli
.env file with your Shopify credentials:# Store information
SHOPIFY_STORE=your-store-name # Without .myshopify.com
# Authentication (choose one option)
# Option 1: Access token (recommended)
SHOPIFY_PASSWORD=shpat_... # Admin API access token
# Option 2: API key and secret
SHOPIFY_API_KEY=... # Admin API key
SHOPIFY_PASSWORD=... # Admin API secret
# Optional
SHOPIFY_THEME_ID=... # Existing theme ID
theme-cli shopify theme init --name my-theme
theme-cli shopify theme dev --store your-store --api-key your-key --password your-password
We provide several scripts to help with development:
# Initial project setup
npm run setup
# Local development (without npm publish)
npm run theme:dev
# Development using published package
npm run theme:dev:npm
# Clean build artifacts and theme files
npm run clean
├── src/ # Source code
│ ├── cli.ts # CLI implementation
│ ├── index.ts # Entry point
│ └── utils/ # Utility functions
├── scripts/ # Development scripts
│ ├── local-theme-dev.sh # Local development
│ ├── project-setup.sh # Project setup
│ └── setup-theme-dev.sh # Published package setup
└── dist/ # Compiled code
The CLI supports two authentication methods:
Access Token (Recommended)
SHOPIFY_PASSWORDAPI Key and Secret
Required API scopes:
read_themeswrite_themesThe development server provides:
Access the development interface at http://localhost:3000 when running the server.
npm installnpm run setupnpm run theme:dev.env fileMIT License - see LICENSE.md for details
FAQs
A CLI tool for developing Shopify themes
The npm package @dscodotco/theme-cli receives a total of 1 weekly downloads. As such, @dscodotco/theme-cli popularity was classified as not popular.
We found that @dscodotco/theme-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.