
Research
/Security News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
client/server command line apps made easy (think tmux)
npm install cmdserver
var util = require('util');
var app = require('cmdserver')(process.argv);
var stacks = {
vegetables: [],
meats: []
};
app.command('add <thing> <stack>')
.describe('add a thing to a specific stack')
.option('method [push|unshift]', 'method for adding. Defaults to `push`', 'push')
.execute(function (client, thing, stack, opts) {
if (!stacks[stack])
return client.send(util.format('don\'t know about `%s`', stack));
stacks[stack][opts.method](thing);
client.send(util.format('%sed `%s` to `%s`', opts.method, thing, stack));
})
app.command('show <stack>')
.describe('show the contents of a specific stack')
.execute(function (client, stack) {
var display = util.inspect(stacks[stack], undefined, undefined, true);
client.send(display);
});
app.command('list stacks')
.describe('show all of the stacks')
.execute(function (client, stack) {
var display = util.inspect(Object.keys(stacks), undefined, undefined, true);
client.send(display);
});
app.command('new <stack>')
.describe('make a brand new stack, hhyyeaaaaa')
.execute(function (client, name) {
stacks[name] = [];
client.send(util.format('adding new stack `%s`', name));
});
app.begin();
You can start a server by doing this:
± node example.js -S /tmp/food.socket
file /tmp/food.socket
debug listening: '/tmp/food.socket'
Then, in another terminal session, you can connect to the server by running the same command:
± node example.js -S /tmp/food.socket
file /tmp/food.socket
/tmp/food.socket < help
/tmp/food.socket >
add <thing> <stack>: add a thing to a specific stack
method [push|unshift] method for adding. Defaults to `push`
show <stack>: show the contents of a specific stack
list stacks: show all of the stacks
new <stack>: make a brand new stack, hhyyeaaaaa
/tmp/food.socket < add beef meats
/tmp/food.socket > pushed `beef` to `meats`
/tmp/food.socket < add 'cold cuts' meats
/tmp/food.socket > pushed `cold cuts` to `meats`
/tmp/food.socket < add 'pork shoulder' meats method=unshift
/tmp/food.socket > unshifted `pork shoulder` to `meats`
/tmp/food.socket < new 'seafood'
/tmp/food.socket > adding new stack `seafood`
You can have as many clients open as you want, go nuts:
# in yet another terminal session
± node example.js -S /tmp/food.socket
file /tmp/food.socket
/tmp/food.socket < list stacks
/tmp/food.socket > [ 'vegetables',
'meats',
'seafood' ]
/tmp/food.socket < show meats
/tmp/food.socket > [ 'pork shoulder',
'beef',
'cold cuts' ]
# you can also perform one-off commands
± node example.js -S /tmp/food.socket "list stacks"
[ 'vegetables',
'meats',
'seafood' ]
If you don't pass any arguments, it will drop you into a REPL
± node example.js
example.js> help
debug
add <thing> <stack>: add a thing to a specific stack
method [push|unshift] method for adding. Defaults to `push`
show <stack>: show the contents of a specific stack
list stacks: show all of the stacks
new <stack>: make a brand new stack, hhyyeaaaaa
example.js> help list stacks
debug
list stacks: show all of the stacks
example.js>
FAQs
client/server command line apps made easy
We found that cmdserver demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Research
/Security News
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Product
Stay on top of alert changes with filtered subscriptions, batched summaries, and notification routing built for triage.