
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@gaodes/pure-dev-kit
Advanced tools


Attribution: This extension is cloned from upstream work by Aliou (
@aliou/pi-dev-kit, formerly@aliou/pi-extension-dev). In this repo, we maintain an adapted fork under the@gaodesscope.
Tools and commands for building, maintaining, and updating Pi extensions.
https://github.com/user-attachments/assets/44a96009-0653-4803-8590-d5a8a5131f4c
Non sped-up versionpi install npm:@gaodes/pure-dev-kit
Or from git:
pi install git:github.com/gaodes/pi-pure-ecosystem
Formerly @aliou/pi-extension-dev and @aliou/pi-dev-kit. This package now continues as a fork under the @gaodes scope; original authorship remains upstream.
/extensions:update [VERSION]Update Pi extensions to a target version. Without an argument, checks npm for the latest version and lets you choose between latest and installed. With a version argument, targets that version directly.
Runs a guided workflow: detects the package manager, compares versions, reads changelogs and docs, analyzes source files for breaking changes, presents an update plan, and applies changes after confirmation.
detect_package_managerDetects the package manager used in the current project. Checks the packageManager field in package.json first, then falls back to lockfile detection (pnpm-lock.yaml, yarn.lock, package-lock.json, bun.lockb). Walks up from the working directory to the git root.
Returns the package manager name, version (if declared), lockfile path, and install/run commands.
pi_versionReturns the version of the currently running Pi instance.
pi_docsLists all Pi documentation files from the Pi installation: README.md, individual files in docs/, and the examples/ directory path.
pi_changelogParses the Pi changelog and returns entries for a specific version (or the latest). When the requested version is newer than the installed Pi, fetches the changelog from GitHub.
Compatible with Pi 0.50.x and 0.51.0+. Tools that need the extension context use a runtime shim to handle the execute signature difference between versions.
FAQs

The npm package @gaodes/pure-dev-kit receives a total of 0 weekly downloads. As such, @gaodes/pure-dev-kit popularity was classified as not popular.
We found that @gaodes/pure-dev-kit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.