
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Comsg is a developer tool that automatically converts Git stagged diffs into clear, consistent, and context-aware commit messages. By analyzing code changes at a semantic level, Comsg helps maintain a clean commit history without requiring developers to manually craft messages for every change.
Comsg supports the full range of Conventional Commit types, including:
These commit types help maintain consistent and meaningful commit history across projects and teams.
Follow these steps to install Comsg globally:
npm i -g comsg
git clone https://github.com/vaibhavjha-dev/comsg
cd comsg
chmod +x index.js
npm link
After installation, the comsg command becomes available system-wide.
Before running Comsg, you must add your OpenAI API key in the project where you want to use this tool.
.env fileIn the root of your project:
nano .env
Add the following environment variable:
OPENAI_API_KEY=your_api_key_here
comsg
Comsg will analyze your current Git stagged diff and generate a commit message based on your changes.
Comsg allows customization of how commit messages are generated.
All customization lives in the index.js file. Inside this file, look for the commit-tool's description, which defines how commit messages should be formatted and structured. Modify the description according to you.
const commitTool = tool({
name: "commit-tool",
description: `
An intelligent tool that transforms raw Git diffs into commit messages...
Rules:
- Always generate commit messages in the format: <type>(<scope>): <description>
- Use types like feat, fix, docs, style, refactor, test, chore
- Scope is optional but should indicate the affected area
- Description should be imperative and concise
- Ensure commit descriptions are 50 characters or less
...
`,
You are ready to use the customized tool.
FAQs
AI-powered commit message generator
We found that comsg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.