
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@go-corp/workflow
Advanced tools
🚀 Enterprise-ready release automation and workflow orchestration
A powerful, type-safe CLI tool built for modern development teams that need consistent, reliable release processes across all their projects.
# Install globally (recommended)
bun install -g @go-corp/workflow
# Or use in project
bun add --dev @go-corp/workflow
# Also available via npm/yarn/pnpm
npm install -g @go-corp/workflow
# Interactive release workflow (recommended)
go-workflow release
# → Prompts for deployment targets (npm, Cloudflare)
# → Handles uncommitted changes interactively
# → Executes complete release pipeline
# Release with specific version bump
go-workflow release --type minor
# Skip specific deployments via CLI flags
go-workflow release --skip-cloudflare --skip-npm
# Force release with uncommitted changes
go-workflow release --force
# Non-interactive mode (for CI/CD)
go-workflow release --non-interactive --skip-cloudflare --skip-npm
# Show workflow status
go-workflow status
go-workflow releaseExecute the complete release workflow with interactive configuration:
🔧 Deployment Configuration
----------------------------------------
✔ 📦 Publish to npm registry? (y/N) · true
⚠️ Uncommitted changes detected:
- README.md
? How would you like to handle uncommitted changes? › 📝 Commit all changes now
✅ Changes committed
✔ Quality Gates
✔ Auto-fix linting issues - ✅ Fixed
✔ Type checking - ✅ Passed
✔ Running tests - ✅ No tests found (skipping)
✔ Git repository analysis - ✅ golive-dev/workflow on main
✔ Version calculation - ✅ 2.10.1 → 2.11.0 (minor)
✔ Deployment configuration - ✅ Will deploy to: npm
✔ Release execution
✔ Update package.json version - ✅ 2.11.0
✔ Generate changelog - ✅ CHANGELOG.md updated
✔ Commit release changes - ✅ chore: release v2.11.0
✔ Create git tag - ✅ v2.11.0
✔ Push to remote - ✅ Complete
✔ Build project - ✅ Build complete
↓ Deploy to Cloudflare [SKIPPED]
✔ Publish to npm - ✅ v2.11.0 published (you may need to interact with prompts)
✔ Create GitHub release - ✅ v2.11.0 released
🎉 Release completed successfully!
📦 Version: 2.10.1 → 2.11.0
📂 Repository: golive-dev/workflow
Options:
--type <patch|minor|major> - Force specific version bump--skip-tests - Skip test execution--skip-lint - Skip linting step--skip-cloudflare - Skip Cloudflare deployment (or use interactive prompt)--skip-npm - Skip npm publishing (or use interactive prompt)--non-interactive - Run without prompts (for CI/CD environments)--force - Skip uncommitted changes check--dry-run - Show what would be done without executing (coming soon)--verbose - Show detailed outputgo-workflow feature (Coming Soon)Create and manage feature branches with AI-powered suggestions:
go-workflow feature # AI suggests branch name
go-workflow feature "add-user-auth" # Create specific feature
go-workflow feature --auto-merge # Enable auto-merge on PR
go-workflow statusShow project and workflow status.
Use as a library in your Node.js applications:
import { createReleaseWorkflow, createTaskEngine, createWorkflow, quickRelease } from '@go-corp/workflow'
// Quick release with interactive prompts
await quickRelease({ type: 'minor' })
// Custom workflow (note: createReleaseWorkflow is now async)
const steps = await createReleaseWorkflow({
skipTests: true,
nonInteractive: true, // Skip prompts for programmatic use
skipCloudflare: true,
skipNpm: true
})
const engine = createTaskEngine({ showTimer: true })
const result = await engine.execute(steps)
// Build custom workflows
const customWorkflow = createWorkflow('deploy')
.step('Build', async (ctx, helpers) => {
helpers.setOutput('Building application...')
// Your build logic
})
.step('Deploy', async (ctx, helpers) => {
helpers.setOutput('Deploying to production...')
// Your deploy logic
})
.build()
Create .go-workflow.config.js in your project root:
export default {
project: {
type: 'library', // 'library' | 'cli' | 'web-app' | 'api'
packageManager: 'bun' // 'bun' | 'npm' | 'yarn' | 'pnpm'
},
git: {
defaultBranch: 'main',
branchNaming: {
feature: 'feature/{name}',
bugfix: 'bugfix/{name}',
hotfix: 'hotfix/{name}'
}
},
deployments: {
npm: {
enabled: true,
access: 'public'
},
cloudflare: {
enabled: true,
buildCommand: 'npm run build'
}
},
github: {
autoRelease: true,
pullRequests: {
autoMerge: true,
deleteBranch: true
}
}
}
gh command)Install once, use everywhere. Same commands and behavior across all your projects.
Enforces code quality before any release:
We welcome contributions! Please see our Contributing Guide for details.
MIT © Go Corp
Built with ❤️ for modern development teams
FAQs
Enterprise-ready release automation and workflow orchestration
We found that @go-corp/workflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.