
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@nimbus-dev/create-connector
Advanced tools
Scaffold a Nimbus MCP connector that performs the contract-version handshake and then serves MCP tools over the same two streams.
npm create @nimbus-dev/connector@latest my-connector # TypeScript
npx @nimbus-dev/create-connector@latest my-connector --lang python # Python
The Python line uses npx deliberately. npm create runs npm exec underneath, which parses
npm's own flags first, so npm create @nimbus-dev/connector@latest my-conn --lang python silently
hands you a TypeScript project. The npm create equivalent is
npm create @nimbus-dev/connector@latest my-conn -- --lang python.
Node ≥22 is needed to run the scaffolder. The generated Python project does not depend on Node.
Full walkthroughs: TypeScript, Python.
Do not add a dotfile to a template assuming it ships. npm removes several names from every
published tarball regardless of files — .gitignore is why templates/*/_gitignore is spelled
that way and renamed by TEMPLATE_FILE_RENAMES in src/generate.ts, and it is not the only such
name. Add the file, then run bun test src/pack-and-generate.test.ts: it packs this package and
generates from the tarball, and it fails if what the registry would ship differs from what the
checkout produces. Let the guard tell you.
MIT.
FAQs
Scaffold a Nimbus MCP connector in TypeScript or Python
We found that @nimbus-dev/create-connector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.