
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
hiro-sdk-cli
Advanced tools
CLI utils for HIRO applications.
npm i -g hiro-sdk-cliInitializes new HIRO Application.
react-scripts v1.1.5 is used for development server / build scripts.
Usage:
hiro-sdk init my-app - initialize blank my-app application.hiro-sdk init my-app -t react - initialize React my-app applicaiton.Advanced usage:
hiro-sdk init my-app -l - initialize blank my-app application and link local hiro-sdk packagehiro-sdk init my-app -t react -l - initialize React my-app applicaiton and link local hiro-sdk packageBundles compiled application into a zip archive.
We need to build our app first.
Run npm run build to create a production build.
As result, we expect a build folder in project root.
It should have the following structure:
build
├── asset-manifest.json
├── icon.svg
├── index.html
└── static
├── css
│ └── main.2c2ee846.css
└── js
└── main.fb659025.js
Important files
icon.svg is used by HIRO Desktop as the icon of the application.
asset-manifest.json contains paths mapping for your assets.
main.js is required. Example asset-manifest.json contents:
{
"main.css": "static/css/main.2c2ee846.css",
"main.js": "static/js/main.fb659025.js"
}
HIRO Desktop loads main.js and all .css files found in manifest.
After we've made a production build, we need to bundle the app.
hiro-sdk bundle command creates a bundle.zip archive in the project root.
Publishes bundled application (bundle.zip) to the graph.
You can provide either host/token/parent combination to command or read those values from env files.
Using explicit arguments:
-h = Graph URL-t = Graph token-p = Desktop "ui" app ID on your installationUsing implicit arguments: just pass -e flag to read arguments from .env files
HIRO_GRAPH_URL = Graph URLHIRO_GRAPH_TOKEN = Graph tokenHIRO_DESKTOP_ID = Desktop "ui" app ID on your installation# Explicit arguments
hiro-sdk publish -h https://acme.graphit.co -t vm8127v89126cn8712616c12c12 -p awv8a57wavmawvawawvaw
# Implicit arguments
hiro-sdk publish -e
As result, your application will be either created or updated, depending on name field in the manifest.yaml.
NOTE, that you can only update applications uploaded by you.
Use hiro-sdk --help to get more info
FAQs
HIRO applications generator.
The npm package hiro-sdk-cli receives a total of 0 weekly downloads. As such, hiro-sdk-cli popularity was classified as not popular.
We found that hiro-sdk-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.