
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
CLI for iceDQ rule and workflow promotion across environments.
Wraps the iceDQ import/export REST APIs to handle authentication, async job polling, multipart bundle uploads, and import log parsing in a single command.
npm install -g @icedq/cli
Requires Node.js 18 or newer.
Set the following environment variables (or pass equivalent flags):
| Variable | Description |
|---|---|
ICEDQ_URL | iceDQ instance base URL, e.g. https://app.icedq.com |
ICEDQ_KEYCLOAK_URL | Keycloak token endpoint base, e.g. https://auth.icedq.com/auth/realms/icedq |
ICEDQ_CLIENT_ID | OAuth client ID (client_credentials grant) |
ICEDQ_CLIENT_SECRET | OAuth client secret |
ICEDQ_ORG_ID | iceDQ organization ID |
ICEDQ_ACCOUNT_ID | iceDQ account ID |
ICEDQ_WORKSPACE_ID | Source/target workspace ID |
icedq exportInitiates an export, polls until complete, downloads the bundle.
icedq export --resource workflow --id wkfl-... --output-file ./finance.zip
icedq export --resource folder --id fldr-... --include-child --output-file ./finance.zip
icedq importSubmits a bundle, polls until complete, parses the log.
icedq import \
--bundle ./finance.zip \
--kind workflows \
--mapping-file ./mapping.json \
--strict \
--retain-log ./icedq-import.log
A hand-authored mapping.json is required in v0.1. Auto-mapping by name (generate-mapping) ships in v0.2.
For CI/CD usage via GitHub Actions, see the Using the iceDQ GitHub Actions guide. It covers prerequisites (Keycloak client_credentials setup, GitHub secrets/environments), quick-start examples, a full Dev → QA → UAT → Prod promotion pipeline, mapping file authoring, self-hosted runners, troubleshooting, and FAQ.
Companion repos:
icedq generate-mapping, icedq jobs, icedq published, icedq validateicedq/export-action, icedq/validate-actionThe build specification is the source of truth for behavior.
FAQs
CLI for iceDQ rule and workflow promotion across environments
The npm package @icedq/cli receives a total of 13 weekly downloads. As such, @icedq/cli popularity was classified as not popular.
We found that @icedq/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.