
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@pubinfo/cli
Advanced tools
Pubinfo 的命令行工具包,对外提供 pubinfo 命令。它负责把业务项目里的 pubinfo.config.ts 转成 Vite 可执行配置,并封装常用工程命令。
dev / build / preview: 先生成 .pubinfo/vite.config.ts,再转调 vitesetup: 初始化 .pubinfo/tsconfig.app.jsoncommit: 复用 @pubinfo/commitlint,提供统一的提交入口generate: 在 monorepo 的 apps/ 下生成一个新应用monorepo: 把现有单体项目迁移成 monorepo 结构upgrade: 升级当前项目中的 pubinfo 和 @pubinfo/module-* 依赖icon: 批量规范化 SVG 图标尺寸和 viewBoxpubinfo dev
pubinfo build
pubinfo preview
pubinfo setup
pubinfo commit
pubinfo generate admin --openapi
pubinfo monorepo --app admin
pubinfo upgrade
pubinfo icon ./src/assets/icons --size 24
这个包本身不维护一套独立的 Vite 配置文件,而是:
pubinfo.config.ts.pubinfo/ 下生成临时 vite.config.tspubinfoConfig.vite因此它和 @pubinfo/vite 是配套设计的,前者负责“执行”,后者负责“生成配置”。
import { main, runMain } from '@pubinfo/cli';
runMain();
pubinfo 包的可执行文件最终会导入这里。generate / monorepo 子命令依赖 create-pubinfo 模板能力。commit 子命令依赖 @pubinfo/commitlint。FAQs
CLI for Pubinfo
The npm package @pubinfo/cli receives a total of 27 weekly downloads. As such, @pubinfo/cli popularity was classified as not popular.
We found that @pubinfo/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.