
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@oss-autopilot/core
Advanced tools
CLI and core library for managing open source contributions. Track PRs, respond to maintainers, discover issues, and maintain contribution velocity.
Part of OSS Autopilot.
npm install -g @oss-autopilot/core
Or run directly:
npx @oss-autopilot/core daily --json
gh) authenticated, or GITHUB_TOKEN environment variable# Daily digest of your open PRs
oss-autopilot daily --json
# Check PR status
oss-autopilot status --json
# Search for contributable issues (positional arg = max result count)
oss-autopilot search 10 --json
# Inspect a PR (read-only metadata lookup — nothing persists)
oss-autopilot track https://github.com/owner/repo/pull/123
# View help
oss-autopilot --help
All commands support --json for structured output:
{
"success": true,
"data": { ... },
"timestamp": "2026-05-04T00:00:00.000Z"
}
import { PRMonitor, getStateManager } from '@oss-autopilot/core';
import { runSearch, runVet } from '@oss-autopilot/core/commands';
const token = process.env.GITHUB_TOKEN!;
// Monitor your open PRs
const monitor = new PRMonitor(token);
const result = await monitor.fetchUserOpenPRs();
// Manage state
const state = getStateManager();
const currentState = state.getState();
// Search for contributable issues (delegates to @oss-scout/core)
const searchResult = await runSearch({ maxResults: 10 });
// Vet a specific issue
const vetResult = await runVet({ issueUrl: 'https://github.com/owner/repo/issues/123' });
For the full AI-powered experience, install as a Claude Code plugin:
/plugin marketplace add costajohnt/oss-autopilot
See the main README for plugin setup.
MIT
FAQs
CLI and core library for managing open source contributions
The npm package @oss-autopilot/core receives a total of 414 weekly downloads. As such, @oss-autopilot/core popularity was classified as not popular.
We found that @oss-autopilot/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.