
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A CLI and GitHub Action that automatically generates pull requests using AI (specifically, Large Language Models or LLMs) from GitHub issues and pull requests.
This tool delivers the ultimate "Vibe Coding" experience, allowing humans to focus solely on writing issues while AI handles all implementation details. Our vision is to create a workflow where developers only need to describe what they want, and the AI translates those requirements into working code.
Currently, we use gen-pr to create scaffolding pull requests. We have five different gen-pr workflows to generate PRs with various combinations of LLMs and coding tools.
We review the pull requests, select the best one, and then continue to write code on the PR manually. This approach has successfully reduced the amount of manually written code.
Below is an analysis report generated by calc-ai-contrib for June 2025, during the development of Exercode.
AI indicates the amount of code written fully automatically by gen-pr. We are very satisfied with the results and consider the AI contribution ratio a key metric for measuring our productivity.
╔══════════════════════════════════════════════════╗
║ CONTRIBUTION ANALYSIS REPORT ║
╠══════════════════════════════════════════════════╣
║ Date: 2025-06-01 to 2025-06-30 (PRs: 91) ║
║ Total Edits: 9,925 (+6,729 / -3,196) ║
╠══════════════════════════════════════════════════╣
║ AI vs Human: [█████░░░░░░░░░░░░░░░░░] 24% / 76% ║
║ Contributors: 1 AI, 6 Human ║
╚══════════════════════════════════════════════════╝
📊 DETAILED BREAKDOWN
────────────────────────────────────────
🤖 AI : [████░░░░░░░░░░░░] 24% | 2,365 Edits (+1,685 / -680)
👥 Human: [████████████░░░░] 76% | 7,560 Edits (+5,044 / -2,516)
@openai/codex, @anthropic-ai/claude-code, and @google/gemini-cli)aider)See action.yml and .github/workflows/gen-pr-example.yml.
Here are some examples for creating PRs for issue #89.
Claude Code:
npx --yes gen-pr@latest --issue-number 89 --coding-tool claude-code
Codex:
npx --yes gen-pr@latest --issue-number 89 --coding-tool codex-cli
Gemini CLI:
npx --yes gen-pr@latest --issue-number 89 --coding-tool gemini-cli
gen-pr can generate an implementation plan by reading files in the target repository using Repomix.
This feature is particularly useful for non-agentic coding tools like Aider.
Gemini 2.5 Pro (gemini/gemini-2.5-pro) for planning and Aider for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model gemini/gemini-2.5-pro --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --aider-extra-args="--model gemini/gemini-2.5-pro --edit-format diff-fenced --test-cmd='yarn check-for-ai' --auto-test"
Claude Opus 4 on Bedrock (bedrock/us.anthropic.claude-opus-4-1-20250805-v1:0) for planning and Aider for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model bedrock/us.anthropic.claude-opus-4-1-20250805-v1:0 --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --aider-extra-args="--model bedrock/us.anthropic.claude-opus-4-1-20250805-v1:0 --test-cmd='yarn check-for-ai' --auto-test"
Gemini 2.5 Pro (gemini/gemini-2.5-pro) for planning and Claude Code for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model gemini/gemini-2.5-pro --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --coding-tool claude-code
o4-mini (openai/o4-mini) for planning and Codex for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model openai/o4-mini --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --coding-tool codex-cli
DeepSeek R1 on OpenRouter (openrouter/deepseek/deepseek-r1-0528:free) for planning and Gemini CLI for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model openrouter/deepseek/deepseek-r1-0528:free --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --coding-tool gemini-cli
Grok 4 (xai/grok-4) for planning and Aider for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model xai/grok-4 --reasoning-effort high --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --aider-extra-args="--model gemini/gemini-2.5-pro --edit-format diff-fenced --test-cmd='yarn check-for-ai' --auto-test"
Local Gemma 3n via Ollama (ollama/gemma3n) for planning and Aider for coding:
npx --yes gen-pr@latest --issue-number 89 --planning-model ollama/gemma3n --repomix-extra-args="--compress --remove-empty-lines --include 'src/**/*.ts'" --aider-extra-args="--model ollama/gemma3n --edit-format diff-fenced --test-cmd='yarn check-for-ai' --auto-test"
Codex:
npx --yes gen-pr@latest --issue-number 103 --coding-tool codex-cli
You can create a YAML configuration file named gen-pr.config.yml or gen-pr.config.yaml in the root of your repository to set default values for options. This config file works for both CLI usage and GitHub Actions. Command-line flags (CLI) or workflow inputs (GitHub Actions) will override values in this file. For example:
repomix-extra-args: "--compress --remove-empty-lines --include 'src/**/*.ts'"
aider-extra-args: '--model gemini/gemini-2.5-pro --edit-format diff-fenced --no-gitignore'
coding-tool: claude-code
test-command: 'yarn check-for-ai'
The tool requires model names defined on llmlite in the format provider/model-name:
openai/gpt-4.1, openai/o4-mini and moreazure/gpt-4.1, azure/o4-mini and moregemini/gemini-2.5-pro, gemini/gemini-2.5-flash and moreanthropic/claude-4-sonnet-latest, anthropic/claude-3-5-haiku-latest and morebedrock/us.anthropic.claude-sonnet-4-20250514-v1:0, bedrock/us.anthropic.claude-3-5-haiku-20241022-v1:0 and morevertex/gemini-2.5-pro, vertex/gemini-2.5-flash and morexai/grok-4, xai/grok-3, xai/grok-3-mini and moreopenrouter/deepseek/deepseek-r1-0528:free, openrouter/deepseek/deepseek-chat-v3-0324:free and moreollama/gemma3n, ollama/deepseek-r1, ollama/qwen3 and moreEach provider uses standard environment variables for authentication:
OPENAI_API_KEYANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKENGEMINI_API_KEY (or GOOGLE_GENERATIVE_AI_API_KEY)OPENAI_API_KEYANTHROPIC_API_KEYGEMINI_API_KEY (or GOOGLE_GENERATIVE_AI_API_KEY)AZURE_OPENAI_API_KEY, AZURE_OPENAI_ENDPOINT, AZURE_OPENAI_API_VERSIONAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_REGION_NAME)GOOGLE_APPLICATION_CREDENTIALS or default service accountXAI_API_KEYOPENROUTER_API_KEYOLLAMA_BASE_URL (default: http://localhost:11434), OLLAMA_API_KEY (optional)Apache License 2.0
FAQs

We found that gen-pr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.