
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A TypeScript ESM module for AI agents and context engineering. This tool provides structured development workflows, configuration management, and utilities for building maintainable, scalable applications with comprehensive error handling.
qerrors for robust error managementqtests runnerdata object and return objectsnpm install
npm test
npm run build
The following helper functions now follow the Universal I/O convention: they accept a single data object as input and return results as an object.
buildTextPrompt
buildTextPrompt(opts) → stringbuildTextPrompt({ opts }) → { prompt: string }const s = buildTextPrompt({ topic, author, minLinks, maxLinks, tone });const { prompt } = buildTextPrompt({ opts: { topic, author, minLinks, maxLinks, tone } });buildImagePrompt
buildImagePrompt(title, topic) → stringbuildImagePrompt({ title, topic, style? }) → { prompt: string }const s = buildImagePrompt(title, topic);const { prompt } = buildImagePrompt({ title, topic, style: 'photo-realistic' });countLinks
countLinks(html) → numbercountLinks({ html }) → { count: number }const n = countLinks(html);const { count } = countLinks({ html });extractImageFromParts
extractImageFromParts(parts) → { mimeType, base64 } | nullextractImageFromParts({ parts }) → { mimeType, base64 } | nullgenerateStructuredPost
generateStructuredPost(ai, model, prompt) → objectgenerateStructuredPost({ ai, model, prompt }) → objectgenerateHeroImage
generateHeroImage(ai, model, prompt) → objectgenerateHeroImage({ ai, model, prompt }) → objectUnchanged APIs
buildBlogSchema() returns a JSON schema object.getLogger() returns an object with info, warn, error methods.Rationale
/lib - Core functionality with single-responsibility functions/config - Configuration files and environment management/tests - Integration tests and test setup/agentRecords - AI agent work records and documentationgenerateBlog(data) → Promise<BlogPost>createGenerateBlog(deps) → (data) => Promise<BlogPost> (factory for DI + reuse)buildTextPrompt({ opts }) → { prompt: string }buildImagePrompt({ title, topic, style? }) → { prompt: string }countLinks({ html }) → { count: number }extractImageFromParts({ parts }) → { mimeType: string; base64: string } | nullbuildBlogSchema() → schema objectgetLogger() → { info, warn, error }generateStructuredPost({ ai, model, prompt }) → objectgenerateHeroImage({ ai, model, prompt }) → { mimeType, base64 }generateBlog function performs informational logging by default (e.g., topic and author) through the qerrors logger.generateBlogCore and inject a logger that redacts or suppresses PII. Example: { logger: { info: () => {}, warn: () => {}, error: console.error } }.generateBlogCore and inject a logger and error wrapper that align with your organization’s standards.dist/ (see exports and files in package.json). Demo/server code is not published.@google/genai, qerrors). Demo/server tooling (e.g., express, winston) lives in devDependencies to reduce supply‑chain surface for module users.The module can infer provider configuration from environment variables if cfg is omitted in generateBlog({ opts, cfg }):
GOOGLE_GENAI_USE_VERTEXAI: 'true' | 'false' — when 'true', Vertex AI is used; otherwise AI Studio API key is used.GOOGLE_CLOUD_PROJECT: GCP project ID for Vertex AI.GOOGLE_CLOUD_LOCATION: GCP region (defaults to 'us-central1').GEMINI_API_KEY: AI Studio API key (server-side only).Defaults used when not specified via opts/env:
'gemini-2.5-flash''gemini-2.5-flash-image-preview''Anonymous'3 / 5import {
generateBlog,
buildTextPrompt,
buildImagePrompt,
countLinks,
extractImageFromParts
} from 'bloggen';
// Generate a full blog post
const post = await generateBlog({
opts: { topic: 'X', author: 'A', minLinks: 3, maxLinks: 5, tone: 'friendly', style: 'photo-realistic' },
cfg: { useVertexAI: false, apiKey: process.env.GEMINI_API_KEY! }
});
// Use helpers directly
const { prompt: textPrompt } = buildTextPrompt({
opts: { topic: 'X', author: 'A', minLinks: 3, maxLinks: 5 }
});
const { prompt: imagePrompt } = buildImagePrompt({ title: 'T', topic: 'X', style: 'watercolor' });
const { count } = countLinks({ html: post.html });
A simple demo server is included to exercise the API from a browser UI.
Run:
node server.js
Open: http://localhost:5000/ (default port 5000)
Endpoints exposed and used by the demo UI:
POST /api/generate-blog
returnImageUrl=true (query or body) to return imageUrl instead of inline base64 imagePOST /api/util/build-text-promptPOST /api/util/build-image-promptPOST /api/util/count-linksGET /api/util/build-blog-schemaPOST /api/util/extract-image-from-partsPOST /api/util/generate-structured-postPOST /api/util/generate-hero-imageGET /api/util/generate-hero-image-binary (binary streaming variant)GET /healthStatic assets are served from public/ (demo HTML/JS lives there) with ETag and Cache-Control: max-age=3600; / redirects to /demo.html.
/api/generate-blog includes { image: { mimeType, base64, alt } }.returnImageUrl=true to receive an imageUrl pointing to GET /api/util/generate-hero-image-binary?model=...&prompt=..., which streams image/* bytes with cache headers.
generateBlog, reducing cold‑start time and baseline memory when consumers import this package but only use pure helpers..meta object for host frameworks to auto‑wire routes, auth, and validation.POST /api/generate-blog → requires user role, apiKeyRequired: true with Zod schema for { opts, cfg }.POST /api/util/generate-structured-post → user + API key; { model, prompt } schema.POST /api/util/generate-hero-image → user + API key; { model, prompt } schema.POST /api/util/build-text-prompt → public; { opts } schema.POST /api/util/build-image-prompt → public; { title, topic, style? } schema.POST /api/util/count-links → public; { html } schema.GET /api/util/build-blog-schema → public; no input schema.Hosts that support .meta can use these to enforce role checks, validate inputs via Zod, and generate API docs automatically.
The rules folders for Cline Code & Kilocode are symlinked to the folder for Roo Code rules. 00-general.md in Roo Code rules is symlinked to AGENTS.md
ln -s "$(pwd)/.roo/rules" "$(pwd)/.kilocode/rules"
ln -s "$(pwd)/.roo/rules" "$(pwd)/.clinerules/"
ln -s "$(pwd)/AGENTS.md" "$(pwd)/.roo/rules/00-general.md"
git remote set-url origin https://github.com/yourusername/yourrepo.git
git remote -v
git fetch
git reset origin/main --hard
FAQs
tool for autogenerating blogs
We found that bloggen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.