
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@rv192/gem-cli-core
Advanced tools

An enhanced command-line AI workflow tool forked from Google Gemini CLI with improved reliability, model fallback mechanisms, and flexible configuration options.
.env file configuration with environment variable supportOption 1: Install globally
npm install -g @rv192/gem-cli
gen
Option 2: Run directly
npx https://github.com/rv192/gen-cli
Create a .env file in your project root or home directory:
# OpenAI-compatible API (Recommended)
OPENAI_BASE_URL=https://your-api-endpoint.com
OPENAI_API_KEY=your-api-key
DEFAULT_MODEL=gemini-2.5-pro
FALLBACK_MODELS=gemini-2.5-flash,gemini-1.5-pro,gemini-2.0-flash
# Or use Google Gemini API directly
GEMINI_API_KEY=your-gemini-api-key
Perfect for using with SiliconFlow, OpenRouter, or other OpenAI-compatible services:
export OPENAI_BASE_URL="https://api.siliconflow.cn/v1"
export OPENAI_API_KEY="your-api-key"
For direct Google Gemini API access:
export GEMINI_API_KEY="your-api-key"
Once configured, start the CLI and begin interacting:
<<<<<<< HEAD
gen
======= 3. Pick a color theme 4. Authenticate: When prompted, sign in with your personal Google account. This will grant you up to 60 model requests per minute and 1,000 model requests per day using Gemini.
You are now ready to use the Gemini CLI!
The Gemini API provides a free tier with 100 requests per day using Gemini 2.5 Pro, control over which model you use, and access to higher rate limits (with a paid plan):
Generate a key from Google AI Studio.
Set it as an environment variable in your terminal. Replace YOUR_API_KEY with your generated key.
export GEMINI_API_KEY="YOUR_API_KEY"
(Optionally) Upgrade your Gemini API project to a paid plan on the API key page (will automatically unlock Tier 1 rate limits)
The Vertex AI provides free tier using express mode for Gemini 2.5 Pro, control over which model you use, and access to higher rate limits with a billing account:
Generate a key from Google Cloud.
Set it as an environment variable in your terminal. Replace YOUR_API_KEY with your generated key and set GOOGLE_GENAI_USE_VERTEXAI to true
export GOOGLE_API_KEY="YOUR_API_KEY"
export GOOGLE_GENAI_USE_VERTEXAI=true
(Optionally) Add a billing account on your project to get access to higher usage limits
For other authentication methods, including Google Workspace accounts, see the authentication guide.
Once the CLI is running, you can start interacting with Gemini from your shell.
You can start a project from a new directory:
12d231e6408f319a1b3af375b8c2eb8ab3ea5b3b
cd new-project/
gen
> Write me a TODO app in React with Tailwind CSS that can track daily tasks
cd your-project/
gen
> Analyze this codebase and suggest performance improvements
> Implement a new feature based on GitHub issue #123
When your primary model (e.g., gemini-2.5-pro) is unavailable:
Trying model: gemini-2.5-pro
Model gemini-2.5-pro failed: Streaming failed after 3 retries, trying next model...
Trying model: gemini-2.5-flash
✅ Successfully connected with gemini-2.5-flash
| Variable | Description | Example |
|---|---|---|
DEFAULT_MODEL | Primary model to use | gemini-2.5-pro |
FALLBACK_MODELS | Comma-separated backup models | gemini-2.5-flash,gemini-1.5-pro |
OPENAI_BASE_URL | API endpoint URL | https://api.siliconflow.cn/v1 |
OPENAI_API_KEY | API authentication key | your-api-key |
GEMINI_API_KEY | Google Gemini API key | your-gemini-key |
The CLI selects models in this order:
--model parameterDEFAULT_MODEL environment variableGEMINI_MODEL environment variable (legacy)When a model fails due to:
The CLI automatically tries the next available model from your FALLBACK_MODELS list.
> Describe the main pieces of this system's architecture
> What security mechanisms are in place?
> Implement a first draft for GitHub issue #123
> Help me migrate this codebase to the latest version of Java
> Make me a slide deck showing git history from the last 7 days
> Create a full-screen web app for displaying GitHub issues
> Generate a project status report from recent commits
> Convert all images in this directory to PNG format
> Organize my PDF invoices by month of expenditure
> Analyze log files and summarize error patterns
> Review this pull request and suggest improvements
> Generate unit tests for the selected functions
> Create documentation for this API endpoint
Model not responding:
"Streaming failed" errors:
FALLBACK_MODELS configurationConfiguration not loading:
.env file is in the correct locationFor more help, see the troubleshooting guide.
npm uninstall -g @rv192/gem-cli
For detailed uninstallation instructions, see the Uninstall Guide.
This project is forked from Google Gemini CLI. For terms of service and privacy notice, see the Terms of Service and Privacy Notice.
Contributions are welcome! Please read the Contributing Guide for details on our development process.
FAQs
Gen CLI Core
We found that @rv192/gem-cli-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.