
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
karabiner-cli
Advanced tools
[](https://oclif.io) [](https://npmjs.org/package/karabiner) [
karabiner-cli/1.2.0 darwin-x64 node-v8.10.0
$ karabiner --help [COMMAND]
USAGE
$ karabiner COMMAND
...
karabiner app:initkarabiner app:versionkarabiner autocomplete [SHELL]karabiner env:copykarabiner env:createkarabiner env:deletekarabiner env:export [FILE]karabiner env:import [FILE]karabiner env:listkarabiner help [COMMAND]karabiner param:copy [FILE]karabiner param:createkarabiner param:deletekarabiner param:listkarabiner update [CHANNEL]karabiner app:initinitialize project for karabiner config management
USAGE
$ karabiner app:init
OPTIONS
-a, --app=app name of app
-f, --force
-h, --help show CLI help
See code: src/commands/app/init.ts
karabiner app:versionlist karabiner app version
USAGE
$ karabiner app:version
OPTIONS
-h, --help show CLI help
See code: src/commands/app/version.ts
karabiner autocomplete [SHELL]display autocomplete installation instructions
USAGE
$ karabiner autocomplete [SHELL]
ARGUMENTS
SHELL shell type
OPTIONS
-r, --refresh-cache Refresh cache (ignores displaying instructions)
EXAMPLES
$ karabiner autocomplete
$ karabiner autocomplete bash
$ karabiner autocomplete zsh
$ karabiner autocomplete --refresh-cache
See code: @oclif/plugin-autocomplete
karabiner env:copydescribe the command here
USAGE
$ karabiner env:copy
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env (required) [default: codepush] environment name (ex. dev|staging|prod)
-f, --force
-h, --help show CLI help
-n, --version=version (required) [default: 1.2.0] app version for associated param
-o, --overwrite
--dest-env=dest-env (required) destination environment name
--dest-region=dest-region (required) [default: us-east-2] destination region
See code: src/commands/env/copy.ts
karabiner env:createcreate new environment
USAGE
$ karabiner env:create
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-h, --help show CLI help
-n, --name=name environment name to create
-r, --region=region aws region
See code: src/commands/env/create.ts
karabiner env:deletedescribe the command here
USAGE
$ karabiner env:delete
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env (required) environment name (ex. dev|staging|prod)
-f, --force
-h, --help show CLI help
-n, --version=version app version for associated param
-x, --extended show extra columns
--columns=columns only show provided columns (comma-separated)
--csv output is csv format
--filter=filter filter property by partial string matching, ex: name=foo
--no-header hide table header from output
--no-truncate do not truncate output to fit screen
--sort=sort property to sort by (prepend '-' for descending)
See code: src/commands/env/delete.ts
karabiner env:export [FILE]export environment configuration to file, environment, etc
USAGE
$ karabiner env:export [FILE]
OPTIONS
-a, --app=app
(required) [default: northone-graphql] application name (ex. my-project)
-d, --dest=dest
relative destination path for rendered config output
-e, --env=env
(required) [default: codepush] environment name (ex. dev|staging|prod)
-f, --format=dotenv|export|yml|json
rendered config output format
Options:
- "dotenv" renders as a .env file
- "bash" prints string of "export VAR_NAME=value"
- "yml" serverless friendly yml array
- "json" simple json
-h, --help
this menu
-n, --version=version
(required) [default: 1.2.0] app version for associated param
-o, --overwrite
allow overwrite of existing config
-r, --resolution=resolve|encrypt|decrypt
rendered config as dynamic resolve strings, encrypted values, or decrypted values
Options:
- "resolve" returns string like "resolve:ssm:/project/env/param-id
- "encrypt" returns encrypted strings
- "decrypt" returns fully decrypted strings (BEWARE)
-s, --save
save settings after successful render
See code: src/commands/env/export.ts
karabiner env:import [FILE]import (read and create at ssm) params from a file and more
USAGE
$ karabiner env:import [FILE]
OPTIONS
-a, --app=app
(required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env
(required) [default: codepush] environment name (ex. dev|staging|prod)
-f, --force
-f, --format=dotenv
rendered config output format
Options:
- "dotenv" renders as a .env file
- "bash" prints string of "export VAR_NAME=value"
- "yml" serverless friendly yml array
- "json" simple json
-h, --help
show CLI help
-n, --version=version
(required) [default: 1.2.0] app version for associated param
See code: src/commands/env/import.ts
karabiner env:listdescribe the command here
USAGE
$ karabiner env:list
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-h, --help show CLI help
-x, --extended show extra columns
--columns=columns only show provided columns (comma-separated)
--csv output is csv format
--filter=filter filter property by partial string matching, ex: name=foo
--no-header hide table header from output
--no-truncate do not truncate output to fit screen
--sort=sort property to sort by (prepend '-' for descending)
See code: src/commands/env/list.ts
karabiner help [COMMAND]display help for karabiner
USAGE
$ karabiner help [COMMAND]
ARGUMENTS
COMMAND command to show help for
OPTIONS
--all see all commands in CLI
See code: @oclif/plugin-help
karabiner param:copy [FILE]TODO
USAGE
$ karabiner param:copy [FILE]
OPTIONS
-f, --force
-h, --help show CLI help
-p, --from=from (required) param name
-t, --to=to param name to copy into
See code: src/commands/param/copy.ts
karabiner param:createcreate new param for app
USAGE
$ karabiner param:create
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env (required) [default: codepush] environment name (ex. dev|staging|prod)
-n, --version=version (required) [default: 1.2.0] app version for associated param
-p, --param-name=param-name (required) param name
-r, --region=region aws region
-v, --param-value=param-value (required) parameter value
See code: src/commands/param/create.ts
karabiner param:deletedelete a parameter from config for an app
USAGE
$ karabiner param:delete
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env (required) [default: codepush] environment name (ex. dev|staging|prod)
-l, --all delete all versions
-n, --version=version (required) [default: 1.2.0] app version for associated param
-p, --param-name=param-name (required) param name
See code: src/commands/param/delete.ts
karabiner param:listlist parameters as config for an app
USAGE
$ karabiner param:list
OPTIONS
-a, --app=app (required) [default: northone-graphql] application name (ex. my-project)
-e, --env=env (required) [default: codepush] environment name (ex. dev|staging|prod)
-h, --help show CLI help
-l, --all show all versions of params
-n, --version=version (required) [default: 1.2.0] app version for associated param
-w, --raw raw aws result
-x, --extended show extra columns
--columns=columns only show provided columns (comma-separated)
--filter=filter filter property by partial string matching, ex: name=foo
--no-header hide table header from output
--no-truncate do not truncate output to fit screen
--sort=sort [default: name] property to sort by (prepend '-' for descending)
See code: src/commands/param/list.ts
karabiner update [CHANNEL]update the karabiner CLI
USAGE
$ karabiner update [CHANNEL]
See code: @oclif/plugin-update
rm -rf /usr/local/karabiner /usr/local/lib/karabiner /usr/local/bin/karabiner ~/.local/share/karabiner ~/Library/Caches/karabiner
FAQs
[](https://oclif.io) [](https://npmjs.org/package/karabiner) [
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.