
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@mindfiredigital/monodog
Advanced tools
Monodog provides visual management and monitoring capabilities for packages in monorepos using pnpm and Turbo. It is distributed as an npm package that can be installed in any monorepo to automatically generate a web UI for package oversight.
This service is typically run locally or on a central server and power a dedicated frontend dashboard.
| Component | Technology | Description |
|---|---|---|
| Language | TypeScript & Node.js | Core language for runtime execution. |
| Framework | Express.js, React | Express Handles all API routing and middleware and React for building the user interface. |
| Styling | Tailwind CSS | Utility-first framework for responsive, modern, and aesthetic design. |
| ORM | Prisma | Database layer for managing package and health status records. |
| VCS | Github | Handles secure auth, automates Changeset PRs, and monitors CI/CD status. |
You must have the following installed to run the service:
pnpmInstall monodog in a monorepo workspace root:
pnpm dlx @mindfiredigital/monodog
Run app using serve script:
cd ./monodog/ && npm run serve
| Method | Route | Purpose | Persistence |
|---|---|---|---|
| GET | /api/packages | Retrieve all package metadata from the database. | Persistent |
| POST | /api/packages/refresh | Trigger a full file scan of the monorepo and update/sync the database. | Triggers write |
| GET | /api/packages/:name | Get detailed info, commits and health status for a package. | Persistent |
| PUT | /api/packages/update-config | Update configuration for a package. | Triggers write |
| GET | /api/health/packages | Fetch the latest health metrics (score, build status) for all packages. | Persistent |
| POST | /api/health/refresh | Recalculate all package health metrics (build, lint, security) and update the database. | Triggers write |
| GET | /api/commits/:packagePath | Fetch Git commit history for a specific package directory. | Persistent |
| GET | /api/config/files | Scan the monorepo for essential configuration files (e.g., tsconfig, .eslintrc). | Generated runtime |
| PUT | /api/config/files/:id | Update a configuration files (e.g., tsconfig, .eslintrc). | Generated runtime |
| GET | /auth/login | Initiate GitHub OAuth 2.0 authentication flow. Redirects to GitHub for authorization. | Session creation |
| GET | /auth/callback | Handle OAuth callback from GitHub with authorization code and validate state parameter. | Session persistence |
| GET | /auth/me | Retrieve authenticated user profile. | Persistent |
| GET | /auth/validate | Validate current session token status. | Persistent |
| GET | /auth/logout | Invalidate session and clear authentication token. | Session termination |
| POST | /auth/refresh | Extend session token validity period. | Session update |
| GET | /api/publish/packages | Retrieve all packages available for publishing. | Persistent |
| GET | /api/publish/changesets | Fetch existing unpublished changesets. | Persistent |
| POST | /api/publish/changesets | Create a new changeset for selected packages. | Triggers write |
| POST | /api/publish/preview | Preview the publish plan with version bumps and validation checks. | Generated runtime |
| GET | /api/publish/status | Check if the repository is ready for publishing. | Persistent |
| POST | /api/publish/trigger | Trigger the GitHub Actions release/publish workflow. | Triggers write |
FAQs
App for monodog monorepo
We found that @mindfiredigital/monodog demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.