
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@unly/cli-confirm
Advanced tools
Rework of https://github.com/jmtoball/cli-confirm
Basically a script that you can call from the cli itself, or within other NPM scripts to confirm an action. Comes handy when you want to add manual confirmation before doing something dangerous.
yarn add -D @unly/cli-confirm
Example of package.json
[…]
"scripts" {
"self-destruct-servers": "cli-confirm \"Do you really want to blow up the servers?\" && yarn destroy:servers",
"destroy:servers": "echo 'servers decommissioned permanently'"
}
[…]
Which would produce the following output:
$ yarn self-destruct-server
Do you really want to blow up the servers? n
$ yarn self-destruct-server
Do you really want to blow up the servers? y
servers decommissioned permanently
$ yarn self-destruct-server
Do you really want to blow up the servers? yes
servers decommissioned permanently
We gladly accept PRs, but please open an issue first so we can discuss it beforehand.
yarn lint
yarn test # Run a manual test which calls our src/index.js
yarn releaseAndPublish # Shortcut - Will prompt for bump version, commit, create git tag, push commit/tag and publish to NPM
yarn release # Will prompt for bump version, commit, create git tag, push commit/tag
npm publish # Will publish to NPM
MIT
The script itself hasn't changed much (additionally allows yes as well as y input), license was updated from ISC to MIT.
As it is a bad practice to rely on software that isn't maintained, nor should be updated, we made our own cli-confirm.
It's basically safer as we don't know who could update the original https://github.com/jmtoball/cli-confirm with additional code.
FAQs
Tiny module to confirm execution of npm scripts
We found that @unly/cli-confirm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.