
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@github/copilot
Advanced tools
GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal.
The power of GitHub Copilot, now in your terminal.
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line, enabling you to build, debug, and understand code through natural language conversations. Powered by the same agentic harness as GitHub's Copilot coding agent, it provides intelligent assistance while staying deeply integrated with your GitHub workflow.
See our official documentation for more information.
We're bringing the power of GitHub Copilot coding agent directly to your terminal. With GitHub Copilot CLI, you can work locally and synchronously with an AI agent that understands your code and GitHub context.
We're still early in our journey, but with your feedback, we're rapidly iterating to make the GitHub Copilot CLI the best possible companion in your terminal.
If you have access to GitHub Copilot via your organization or enterprise, you cannot use GitHub Copilot CLI if your organization owner or enterprise administrator has disabled it in the organization or enterprise settings. See Managing policies and features for GitHub Copilot in your organization for more information.
Install with WinGet (Windows):
winget install GitHub.Copilot
winget install GitHub.Copilot.Prerelease
Install with Homebrew (macOS and Linux):
brew install copilot-cli
brew install copilot-cli@prerelease
Install with npm (macOS, Linux, and Windows):
npm install -g @github/copilot
npm install -g @github/copilot@prerelease
Install with the install script (macOS and Linux):
curl -fsSL https://gh.io/copilot-install | bash
Or
wget -qO- https://gh.io/copilot-install | bash
Use | sudo bash to run as root and install to /usr/local/bin.
Set PREFIX to install to $PREFIX/bin/ directory. Defaults to /usr/local
when run as root or $HOME/.local when run as a non-root user.
Set VERSION to install a specific version. Defaults to the latest version.
For example, to install version v0.0.369 to a custom directory:
curl -fsSL https://gh.io/copilot-install | VERSION="v0.0.369" PREFIX="$HOME/custom" bash
copilot
On first launch, you'll be greeted with our adorable animated banner! If you'd like to see this banner again, launch copilot with the --banner flag.
If you're not currently logged in to GitHub, you'll be prompted to use the /login slash command. Enter this command and follow the on-screen instructions to authenticate.
You can also authenticate using a fine-grained PAT with the "Copilot Requests" permission enabled.
GH_TOKEN or GITHUB_TOKEN (in order of precedence)Launch copilot in a folder that contains code you want to work with.
By default, copilot utilizes Claude Sonnet 4.5. Run the /model slash command to choose from other available models, including Claude Sonnet 4 and GPT-5.
Each time you submit a prompt to GitHub Copilot CLI, your monthly quota of premium requests is reduced by one. For information about premium requests, see About premium requests.
For more information about how to use the GitHub Copilot CLI, see our official documentation.
We're excited to have you join us early in the Copilot CLI journey.
This is an early-stage preview, and we're building quickly. Expect frequent updates--please keep your client up to date for the latest features and fixes!
Your insights are invaluable! Open issue in this repo, join Discussions, and run /feedback from the CLI to submit a confidential feedback survey!
FAQs
GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal.
The npm package @github/copilot receives a total of 52,831 weekly downloads. As such, @github/copilot popularity was classified as popular.
We found that @github/copilot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 20 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.