
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@localey/cli
Advanced tools
Localization that feels like TypeScript.
Localey is a high-precision, component-centric localization engine designed for modern web and mobile apps. It automates the extraction of hardcoded strings, generates semantic translation keys using AI, and ensures 100% type safety.
#ffffff), CSS units (10px, 1rem), numbers, and technical constants.LoginForm.SUBMIT).app or index).ignoreAttributes: Blacklist custom props from extraction in your localey.config.json./* localey-ignore */: Skip specific lines or elements with a simple comment.as any to t() calls in JSX props to satisfy strict TypeScript union types.ai.auto: Enable AI in your config, and Localey will automatically use it for every extraction.Button, Text) to decide on prefixes (BTN_, LBL_).npm install -g @localey/cli
localey setup
This generates localey.config.json and sets up your i18n infrastructure.
Add your AI key and custom exclusions to localey.config.json:
{
"frameworks": ["react"],
"ignoreAttributes": ["rightIcon", "headerLeft"],
"ai": {
"provider": "openai",
"apiKey": "sk-...",
"auto": true
}
}
localey extract --dir ./src
Or use the real-time watcher:
localey dev --dir ./src
Want to skip a specific string?
<Text>{/* localey-ignore */}Not for translation</Text>
<div className="bg-[#ea580c]" /> // Automatically skipped
MIT
FAQs
**Localization that feels like TypeScript.**
We found that @localey/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.