
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@g1suite/api-cli
Advanced tools
CLI for scaffolding API Node servers and Cloudflare Worker apps, plus generating routes with paths and per-method handlers.
CLI for scaffolding API Node servers and Cloudflare Worker apps, plus generating routes with paths and per-method handlers.
nx run api-cli:build
node dist/cli.js create --name my-api --template api --dir apps/my-api
node dist/cli.js create --name my-worker --template cloudflare-worker --dir apps/my-worker
node dist/cli.js generate route --name user --path "/users/:id" --methods "GET,DELETE" --dir apps/my-api
# Produces: apps/my-api/src/routes/v1/users/[id].ts (version auto-detected)
# Exports named methods: GET, DELETE
# Explicitly write under v2
node dist/cli.js generate route --name hello --dir apps/my-api --api-version v2
# Preview planned files without writing
node dist/cli.js generate route --name hello --dir apps/my-api --dry-run
node dist/cli.js generate version --api-version v2 --dir apps/my-api
# Produces: apps/my-api/src/routes/v2/index.ts
app.ts:node dist/cli.js generate aggregated --dir apps/my-api --patch-app
# Writes: apps/my-api/src/routes/index.ts that imports all detected versions
# If --patch-app is set, adds import and calls registerAllVersions(app) in src/app.ts
node dist/cli.js generate route --name user --path "/users/:id" --methods "GET,DELETE" --dir apps/my-worker
# Registers in src/routes/index.ts as a method map for "/users/:id"
src/routes/<version>/... (e.g., src/routes/v1)..g1api.json defaultApiVersion (if present)src/app.ts import/mount patterns (e.g., from './routes/<ver>/index' or app.route('/<ver>', vApp))src/routes/<ver>/index.tsv1--api-version <ver> on generate route.src/routes/index.ts and mounts each version under its prefix.src/routes/v1/users/[id].ts maps to /users/:id at runtime./users/:id or /users/[id] in the registry; both are supported by the template router.export async function GET) are registered per method by the framework loader. If only a default export exists, it is treated as GET.node dist/cli.js start --dir apps/my-api
# Runs: bunx tsx scripts/prepare-docs-assets.ts && bunx tsx watch src/server.ts
node dist/cli.js start --dir apps/my-worker
# Prints: wrangler dev
nx run api-cli:start -- --dry-run --dir templates/project/api
# Outputs: Start command: bunx tsx watch src/server.ts
nx run api-cli:start -- --dir apps/my-api
nx run api-cli:start -- --dir apps/my-worker
--dir is resolved relative to packages/api-cli when run via Nx.templates/project/api or absolute paths for fixtures.src/server.ts (API) or wrangler.toml (Worker).nx run api-cli:dev -- --dry-run --dir templates/project/cloudflare-worker
--dir from workspace root:nx run api-cli:start -- --dry-run --root --dir packages/api-cli/templates/project/api
nx run api-cli:dev -- --dry-run --root --dir packages/api-cli/templates/project/cloudflare-worker
npx @g1suite/api-cli@latest create --name my-api --template api --dir apps/my-api
npx @g1suite/api-cli@latest update --dir apps/my-api
npx @g1suite/api-cli@latest doctor --dir apps/my-api
npx @g1suite/api-cli@latest migrate --dir apps/my-api --dry-run
bunx if installed:bunx @g1suite/api-cli create --name my-worker --template cloudflare-worker --dir apps/my-worker
Notes:
--root resolves --dir relative to the Nx workspace root.--root, --dir resolves relative to the current working directory.create include a g1-template.json file at the project root:{
"template": "api",
"templateVersion": "2.0.0",
"files": {
"src/server.ts": "<sha256>",
"src/routes/index.ts": "<sha256>"
}
}
node dist/cli.js update --dir apps/my-api
# or
npx @g1suite/api-cli@latest update --dir apps/my-api
node dist/cli.js doctor --dir apps/my-api
# or
npx @g1suite/api-cli@latest doctor --dir apps/my-api
node dist/cli.js migrate --dir apps/my-api --dry-run
# or
npx @g1suite/api-cli@latest migrate --dir apps/my-api --dry-run
bun update / npm update).doctor to verify project health.node dist/cli.js migrate-version --to v2 --dir apps/my-api
# Creates: src/routes/v2/index.ts, mounts at /v2 in src/app.ts, updates .g1api.json
Notes:
v<number> (e.g., v2) or vYYYY-MM (e.g., v2025-11)..g1api.json is updated with defaultApiVersion and multipleVersions: true when migrating..g1api.json to track API versioning defaults:{
"defaultApiVersion": "v1",
"multipleVersions": false
}
defaultApiVersion unless overridden by --api-version.npx @g1suite/api-cli@latest migrate --dir apps/my-api --apply
dependencies and devDependencies with the chosen template.g1-template.json exists, updates templateVersion to the CLI’s version.g1-template.json.The CLI supports lightweight plugins to extend behavior for doctor and migrate.
Plugins are discovered via either:
api-cli.config.json at project root with { "plugins": ["<name>", "<name>"] }.
package.json fields g1ApiCli.plugins or names starting with @g1suite/api-cli-plugin-.
Plugin interface (TypeScript):
export type ApiCliPluginContext = {
root: string;
template: string | null;
cliVersion: string;
metadata: any;
log: (msg: string) => void;
};
export type ApiCliPlugin = {
name?: string;
doctor?: (ctx: ApiCliPluginContext) => Promise<void> | void;
migratePlan?: (ctx: ApiCliPluginContext) => Promise<void> | void;
migrateApply?: (ctx: ApiCliPluginContext) => Promise<void> | void;
};
// my-plugins/api-health-check.js
export default {
name: "api-health-check",
async doctor(ctx) {
ctx.log("Plugin: running extra health checks...");
// custom checks here
},
async migratePlan(ctx) {
ctx.log("Plugin: suggesting additional steps for migration plan...");
},
async migrateApply(ctx) {
ctx.log("Plugin: applying additional adjustments...");
}
};
api-cli.config.json:{
"plugins": [
"./my-plugins/api-health-check.js",
"@g1suite/api-cli-plugin-example"
]
}
ctx.log for consistent output.FAQs
CLI for scaffolding API Node servers and Cloudflare Worker apps, plus generating routes with paths and per-method handlers.
We found that @g1suite/api-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.