
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@springtree/eva-cli
Advanced tools
This command line tool will be used to switch environments within eva cli projects.
This command line tool will be used to switch environments within eva cli projects.
Te begin using the eva-cli you can either install it globally or on project level:
Globally
npm install -g @springtree/eva-cli
Which can be invoked like so
eva
On project level
npm install @springtree/eva-cli
Which can be invoked like so
npx eva
To use this tool, you will need to setup authentication with github tokens first.
eva-cli to confirm you have access. The token will require the read:org and read:user scopes, see github creating a personal token guide for more information hereset-token command like soeva set-token --token=TOKEN_HERE
If you ever need to verify if your token is still valid you can use the verify-token command like so.
eva verify-token
You can now use the tool in any eva cli project, which require a eva-cli.json in root of the project. Which looks like so, every key in this object is explained in the eva-cli section down below.
{
"version": 1,
"assets": {
"appIcon": "src/assets",
"appLogo": "src/assets",
"appSplashScreen": "src/assets",
"appSplashScreenGif": "src/assets",
"colors": "src/theme",
"eva-config": "src/assets/env"
},
"framework": "ionic",
"projectName": "eva-companion-app"
}
Once the eva-cli.json is configured correctly, and you are authenticated successfully you can use this tool by running the switch command.
eva switch
This will let you choose interactively choose a customer and target.
For CI, you won't be calling set-token but the switch:ci command with same flags as the regular switch command. For authentication it will either look at the EVA_SWITCH_TOKEN environment variable or you can pass the token as a flag like so.
eva switch:ci --token=TOKEN_HERE
eva-cli.json fileThe eva-cli.json file holds the configuration which the eva-cli will look at once executed, it will help the tool determine which project its being used in and which assets to fetch.
The assets object key will represent any project's assets defined in on the customer manager here.
The key will essentially be used as an identefier to find the matching customer project asset which will be uploaded
on the customer manager as well under https://eva-customer-manager.firebaseapp.com/customers/details/:customerId/:projectId
The value of any key under assets will be the path where you would like to copy the uploaded asset. The copied file name will be equal to the asset id regardless of the original uploaded file name.
The eva-config key here is a special one, as its a preserved key for the selected target which gets written under the file name eva-config.json
The framework key can be any of the values of 'ionic' | 'angular' | 'flutter' | 'react' | 'xcode' to help collect usage data and have framework specific behavior in the future.
the projectName needs to be an existing project under projects in the customer manager. It will be used by the eva-cli to show you relevant customers for this project.
These are the possible commands in a nutshell as outlined here above.
Usage: eva [options] [command]
Commands:
set-token [options] [args] Sets the github personal access token
switch:ci [options] [args] Switches environment, to be used in a CI environment
switch Switch eva environment interactively
verify-token [options] [args] Verifies the currently saved token or the passed token is valid
FAQs
This command line tool will be used to switch environments within eva cli projects.
We found that @springtree/eva-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.