
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses. Originally designed for Claude CLI, now supports multiple AI coding assistants.
⚠️ Important Security Warning: Only run this on trusted repositories. This tool automatically responds to prompts and can execute commands without user confirmation. Be aware of potential prompt injection attacks where malicious code or instructions could be embedded in files or user inputs to manipulate the automated responses.
ESC or Ctrl+CInstall the AI CLI tool(s) you want to use:
npm install -g @anthropic-ai/claude-code
Learn more: https://www.anthropic.com/claude-code
# Install Gemini CLI (if available)
# Check Google's documentation for installation instructions
# Install Codex CLI (if available)
# Check Microsoft's documentation for installation instructions
# Install GitHub Copilot CLI
# Check GitHub's documentation for installation instructions
# Install Cursor agent CLI
# Check Cursor's documentation for installation instructions
npm install -g @vibe-kit/grok-cli
Learn more: https://github.com/vibe-kit/grok-cli
Then install this project:
npm install cli-yes -g
claude-yes [--exit-on-idle=60s] [tool-command] [prompts]
Claude (default):
claude-yes -- run all tests and commit current changes
bunx claude-yes "Solve TODO.md"
Other AI tools:
# Use Codex directly
codex-yes -- refactor this function
# Use Grok directly
grok-yes -- help me with this code
# Use Copilot directly
copilot-yes -- generate unit tests
# Use Cursor directly
cursor-yes -- optimize performance
# Use Gemini directly
gemini-yes -- debug this code
claude-yes "help me with this code"
claude-yes "optimize performance"
Auto-exit when idle (useful for automation):
claude-yes --exit-on-idle=60s "run all tests and commit current changes"
Alternative with claude-code-execute:
claude-code-execute claude-yes "your task here"
| Tool | CLI Name | Description | Installation/Update |
|---|---|---|---|
| Claude | claude | Anthropic's Claude Code (default) | npm install -g @anthropic-ai/claude-code@latest |
| Gemini | gemini | Google's Gemini CLI | npm install -g @google/gemini-cli@latest |
| Codex | codex | OpenAI's Codex CLI | npm install -g @openai/codex-cli@latest |
| Copilot | copilot | GitHub Copilot CLI | npm install -g @github/copilot@latest |
| Cursor | cursor | Cursor agent CLI | See https://cursor.com/ja/docs/cli/installation |
| Grok | grok | Vibe Kit's Grok CLI | npm install -g @vibe-kit/grok-cli@latest |
| Qwen | qwen | Alibaba's Qwen Code CLI | npm install -g @qwen-code/qwen-code@latest |
The tool will:
--exit-on-idle flag, automatically exit when the tool becomes idlePros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
--cli=<tool>: Specify which AI CLI tool to use (claude, gemini, codex, copilot, cursor). Defaults to claude.--exit-on-idle=<seconds>: Automatically exit when the AI tool becomes idle for the specified duration. Useful for automation scripts.You can also use this as a library in your Node.js projects:
import claudeYes from 'claude-yes';
// Use Claude
await claudeYes({
prompt: 'help me solve all todos in my codebase',
cli: 'claude',
cliArgs: ['--verbose'],
exitOnIdle: 30000, // exit after 30 seconds of idle
continueOnCrash: true,
logFile: 'claude.log',
});
// Use other tools
await claudeYes({
prompt: 'debug this function',
cli: 'gemini',
exitOnIdle: 60000,
});
The tool uses node-pty to spawn and manage AI CLI processes, with a sophisticated pattern-matching system that:
Each supported CLI has its own configuration defining:
--search to Codex)node-pty or bun-pty - For spawning and managing AI CLI processesfrom-node-stream - Stream processing utilitiessflow - Functional stream processingterminal-render - Terminal rendering and text processingphpdie - Error handling utilitiesThis project was inspired by: Claude Code full auto while I sleep : r/ClaudeAI
MIT
FAQs
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.
We found that cli-yes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.