
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@gitlab/duo-cli
Advanced tools
GitLab Duo for your command line. An AI-powered CLI tool that brings GitLab Duo Chat (Agentic) to your terminal.
The GitLab Duo CLI can help you:
This tool is experimental and some features might not work as expected.
Prerequisites:
api
scope.To install the GitLab Duo CLI globally, run:
npm install -g @gitlab/duo-cli
You can use the installation script to install the GitLab Duo CLI without Node.js:
bash <(curl -fsSL "https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/raw/main/packages/cli/scripts/install_duo_cli.sh")
irm "https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/raw/main/packages/cli/scripts/install_duo_cli.ps1" | iex
This script will:
~/.local/bin/duoFor non-interactive installation (useful for CI/CD):
curl -fsSL https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/raw/main/packages/cli/scripts/install_duo_cli.sh | bash -s -- -y
To install a specific version:
curl -fsSL https://gitlab.com/gitlab-org/editor-extensions/gitlab-lsp/-/raw/main/packages/cli/scripts/install_duo_cli.sh | bash -s -- --version 1.2.3
After installation, you can run the GitLab Duo CLI using the duo command.
To update to the latest version:
npm install -g @gitlab/duo-cli@latest
Start the interactive terminal UI:
duo
Alternatively, you can run the GitLab Duo CLI without installing:
npx -y @gitlab/duo-cli
To run a workflow in headless mode, use the command duo run:
[!warning] Headless mode bypasses manual tool approval. Use this mode with caution and in a controlled sandbox environment.
duo run --goal "Your goal or prompt here"
For detailed setup, usage, troubleshooting, and configuration instructions, see the GitLab Duo CLI documentation.
See Development Guide for information on contributing to this project.
See the License for details.
FAQs
GitLab Duo for your command line
The npm package @gitlab/duo-cli receives a total of 92,976 weekly downloads. As such, @gitlab/duo-cli popularity was classified as popular.
We found that @gitlab/duo-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.