
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
Lets is an easy-to-use yet flexible remote task automatisation tool. Think of it as a JavaScript-clone of Capistrano, with a touch of Dandelion, and some inspiration from Grunt. The aim of this project is to make it more convenient for anyone to automate those tasks that really should be done automatically. Like deployment.
Lets is currently under early and heavy development. It's possible it will work. It's also possible something will get terribly and irreversibly messed up. Use at your own discretion. With that said, I'm thankful for any help with real-life testing and evaluation I can get.
Short version:
npm install lets-cli -gnpm install letsLong version:
Step one: install node
First of all, you'll need node.js and npm installed on your local machine (or
the machine where these scripts are going to be initated).
Go and get it if you don't have it installed already!
Step two: install the CLI
Secondly you'll want to use Lets from the command-line (yes, you do).
Install lets-cli globally:
npm install lets-cli -g
Step three: install Lets in your project
Finally you have to install Lets itself locally in your project. This is
similar to how Grunt works too, if you've used Grunt.
npm install lets
Step four: use plugins
Now you are ready to go! What's left to do is to configure what tasks to run by
putting a Letsfile.js in the root of your project.
I will probably create a collection of Letsfile.js examples and maybe even a
scaffolding-script when i have time. For now you can have a look at the example
for lets-git-pull to get an idea of how things work.
A plugin is simply a way of speeding up your configuration by collecting a bunch of tasks in a package. You can find currently available plugins in the list of Lets plugins below.
Extensive documentation on methods, options, tasks, events and flows coming soon.
Currently there are a handfull official (e.i. maintained by me) plugins. My hopes are that there will soon be a plugin for any conceivable way of deploying or executing remote tasks.
Missing something? Feel free to create a plugin yourself! I'm for example aware of a lack of support for other vcs's than git.
None at the moment :( But soon you'll find a list of plugins maintained by others here.
Coming soon
So you wanna help out? Great! I can always do with more hands to help. If you think something needs to be improved, just create an issue. Do so even if you intend to fix it yourself to ensure that no one else is already working on it and that we agree on how it should be done (unless it's the tinyest little silly fix, like a typo). Fork from the develop-branch, create a feature-branch, and pull-request back to develop.
A LOT.
FAQs
The simple server deployment and task automation tool
We found that lets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.