
Research
/Security News
Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.
Non-interactive hunk staging for AI agents. A better git add.
Built with Bun + Bunli. TypeScript rewrite of nexxeln/git-hunk (Rust) — same core concepts (snapshots, change keys, hunk-level staging), redesigned for agent workflows.
--path selector — stage entire files without extracting change keys. Agents spent most of their time mapping files to change keys via python one-liners; now --path src/lib.ts,src/other.ts just works.--summary scan mode — file-level overview without hunks or changes. The orchestrator only needs filenames and line counts to form groups, not 649 change keys.commit which mixed concerns. This version does one thing: stage precisely. Use regular git commit after.bun install
# File-level overview
git-hunk scan --summary --json
# Change-level detail
git-hunk scan --compact --json
# Stage whole files
git-hunk stage --snapshot <id> --path src/lib.ts,src/other.ts --json
# Stage specific changes
git-hunk stage --snapshot <id> --change-key ck_abc,ck_def --json
# Preview before staging
git-hunk stage --snapshot <id> --path src/lib.ts --dry-run --json
# Stage everything
git-hunk stage --snapshot <id> --all --json
# Inspect a change
git-hunk show <change-key> --json
# Unstage
git-hunk unstage --snapshot <id> --path src/lib.ts --json
bun dev -- scan --summary --json
bun test
bun run typecheck
FAQs
Non-interactive hunk staging for AI agents
The npm package git-hunk receives a total of 3 weekly downloads. As such, git-hunk popularity was classified as not popular.
We found that git-hunk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Laravel Lang packages were compromised with an RCE backdoor across hundreds of versions, exposing cloud, CI/CD, and developer secrets.

Security News
Socket found a malicious postinstall hook across 700+ GitHub repos, including PHP packages on Packagist and Node.js project repositories.

Security News
Vibe coding at scale is reshaping how packages are created, contributed, and selected across the software supply chain