
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A cross-platform Node.js CLI tool that manages multiple SSH keys and Git author profiles.
cd gssh-node
npm install
npm run build
# Install globally (optional)
npm link
npm install -g gssh
gssh list
gssh add myprofile
# Interactive wizard will prompt for Git author name, email, and generate SSH key
# Set Git config globally (default)
gssh use myprofile
# Set Git config locally (current repo only)
gssh use myprofile -l
gssh current
gssh pubkey
# Automatically copies to clipboard (macOS/Linux/Windows)
gssh remove myprofile
# Safety checks prevent accidental deletion of active profile
gssh
# Shows menu, current profile, and public key
Profiles are stored in ~/.ssh/profiles/<profile-name>/:
~/.ssh/profiles/
├── work/
│ ├── id_ed25519 # Private key
│ ├── id_ed25519.pub # Public key
│ └── git_author.txt # Git author info
└── personal/
├── id_ed25519
├── id_ed25519.pub
└── git_author.txt
Active profile is tracked using two methods:
~/.ssh/git-ssh-active.txt~/.ssh/ with profile keysThe git_author.txt file supports two formats:
Single line:
John Doe <john@example.com>
Two lines:
John Doe
john@example.com
src/
├── index.ts # Main entry point
├── cli.ts # Commander.js setup
├── types.ts # TypeScript interfaces
├── paths.ts # Filesystem path management
├── git-author.ts # Git config management
├── keypair.ts # SSH key operations
├── utils/
│ ├── clipboard.ts # Platform-specific clipboard
│ ├── prompts.ts # Interactive prompts
│ ├── errors.ts # Error handling
│ └── platform.ts # Platform detection
└── commands/
├── list.ts # List profiles
├── use.ts # Switch profiles
├── add.ts # Create profiles
├── remove.ts # Delete profiles
├── current.ts # Show active profile
├── pubkey.ts # Display public key
├── import.ts # Auto-import existing keys
├── menu.ts # Default menu
└── shared.ts # Shared utilities
On Unix-like systems (macOS, Linux):
chmod 600 (read-only by owner)chmod 644 (readable by all)On Windows: Relies on NTFS permissions (not explicitly managed)
Platform-specific clipboard commands:
pbcopyclipxclip, xsel, wl-copy (tries multiple)# Install dependencies
npm install
# Build TypeScript
npm run build
# Watch mode (development)
npm run dev
# Clean build artifacts
npm run clean
readline instead of external prompt librariesexeca for shell commands instead of std::process::Commandssh-keygen (for generating keys)git (for setting config)MIT
FAQs
SSH + Git author profile manager
We found that gssh demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.