
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Agent-first CLI for Ashby's official API.
This CLI is intended for operational workflows around:
It is intentionally scoped to state and workflow mutation, not the full Ashby UI surface.
Package name: ashby-cli
Binary name: ashby
npm install -g ashby-cli
If you do not want a global install, invoke the published package directly:
npx -y ashby-cli doctor --json
Or from source:
git clone https://github.com/danielgwilson/ashby-cli.git
cd ashby-cli
npm install
npm run build
Ashby uses HTTP Basic auth with the API key as the username and a blank password.
Ashby does not expose OAuth for this API. The easiest human setup path is browser-assisted API key creation.
You can either:
ASHBY_API_KEYashby auth setup
ashby auth set --stdin
ashby auth status
ashby doctor
If you are using npx, remember it will not load .env.local automatically. Export ASHBY_API_KEY first or source your env file in the shell.
ashby auth setup
This will:
If you prefer not to install globally:
npx -y ashby-cli auth setup
ashby auth set --stdin
ashby auth status --json
ashby auth clear
ashby doctor --json
ashby whoami --json
ashby candidate search --name "Jane Doe" --json
ashby candidate search --email "jane@example.com" --json
ashby candidate search --name "Jane Doe" --email "jane@example.com" --json
ashby candidate get <candidate-id> --json
ashby candidate notes --candidate-id <candidate-id> --json
ashby candidate create --name "Jane Doe" --email "jane@example.com" --linkedin-url "https://linkedin.com/in/jane" --json
ashby candidate update --candidate-id <candidate-id> --github-url "https://github.com/jane" --suppress-notifications --json
ashby candidate upsert --name "Jane Doe" --email "jane@example.com" --phone-number "+14155550123" --json
ashby note create --candidate-id <candidate-id> --note "Strong fast-track candidate" --json
ashby note ensure --candidate-id <candidate-id> --marker "AHH 2026" --note-file ./note.txt --json
ashby application list --job-id <job-id> --status Active --json
ashby application get <application-id> --json
ashby application history --application-id <application-id> --json
ashby application feedback --application-id <application-id> --json
ashby application feed --application-id <application-id> --json
ashby application create --candidate-id <candidate-id> --job-id <job-id> --interview-stage-id <stage-id> --json
ashby application stage-change --application-id <application-id> --interview-stage-id <stage-id> --json
ashby job list --status Open,Draft --json
ashby job get <job-id> --json
ashby job search --title "Founding Engineer" --json
ashby interview-plan list --json
ashby stage list --interview-plan-id <plan-id> --json
ashby stage list --job-id <job-id> --json
ashby source list --json
ashby interview schedules --application-id <application-id> --json
ashby interview events --application-id <application-id> --json
ashby application feed reconstructs a useful candidate/application timeline from public API data:
It does not provide full parity with the Ashby web UI feed. In particular, public API coverage still appears weak or absent for:
See docs/CONTRACT_V1.md for the stable CLI contract.
FAQs
Agent-first CLI for Ashby's official API
The npm package ashby-cli receives a total of 6 weekly downloads. As such, ashby-cli popularity was classified as not popular.
We found that ashby-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.