
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Enterprise-grade meta-CLI toolkit for modern development workflows
mret is a comprehensive command-line interface toolkit designed for modern software development teams. It consolidates 40+ essential development operations into a single, unified interface, eliminating context switching and streamlining workflows across security, testing, deployment, and code quality domains.
npm install -g mret
yarn global add mret
mret --version
mret --help
Initialize a new project with best practices:
# Create project structure
mret init
# Configure security
mret env encrypt
mret secrets scan
# Set up quality gates
mret hooks install
mret coverage --threshold 80
# Verify dependencies
mret audit check
mret license
# Test deployment pipeline
mret act validate
Military-grade AES-256-CBC encryption for sensitive configuration data. Supports multiple environments with automatic backup and rollback capabilities.
Key Features:
Pattern-based scanning for exposed credentials across your codebase. Detects AWS keys, GitHub tokens, API secrets, private keys, and custom patterns.
Supported Detection Patterns:
Integrated dependency security auditing with npm, yarn, and pnpm support. Provides severity-based filtering, interactive remediation, and automated fix capabilities.
Capabilities:
Automated license auditing for all project dependencies with configurable allow-lists and policy enforcement.
Visual command construction interface with pre-built templates for common development tasks. Supports Docker, Git, NPM, and framework-specific commands.
Template Categories:
Native completion support for Bash, Zsh, and Fish shells with dynamic command discovery and argument suggestions.
Installation:
# Auto-detect shell and install
mret completion install
# Specific shell
mret completion install --shell zsh
# Generate script for manual installation
mret completion generate --shell bash > /etc/bash_completion.d/mret
Create persistent shortcuts for frequently used command sequences with parameter support.
Example Usage:
# Define aliases
mret alias create deploy-staging "npm run build && firebase deploy --only hosting:staging"
mret alias create test-ci "npm run lint && npm test -- --coverage && npm run build"
# Execute aliases
mret run deploy-staging
mret run test-ci
Execute GitHub Actions workflows locally using nektos/act, enabling pre-deployment validation and faster iteration cycles.
Workflow:
# Install act runtime
mret act setup
# List available workflows
mret act list
# Test specific workflow
mret act run ci
# Test specific job
mret act run ci --job build
# Dry run
mret act run ci --dry-run
# Validate syntax
mret act validate
Parse and analyze test coverage reports from Jest, NYC, and other coverage tools. Enforce minimum coverage thresholds in CI/CD pipelines.
Configuration:
# Check coverage with default threshold (80%)
mret coverage
# Set custom threshold
mret coverage --threshold 90
# Integrate with CI
mret coverage --threshold 85 || exit 1
Unified deployment interface for Vercel, Netlify, and Firebase with automatic platform detection and configuration.
Supported Platforms:
Usage:
# Auto-detect platform
mret deploy
# Explicit platform
mret deploy --provider vercel
mret deploy --provider netlify
mret deploy --provider firebase
Measure and analyze build times to identify bottlenecks and optimization opportunities.
# Profile build command
mret profile "npm run build"
# Output includes:
# - Total build time
# - Performance recommendations
# - Bottleneck identification
Automated backup solutions for PostgreSQL, MySQL, and MongoDB with configurable retention policies.
Supported Databases:
# PostgreSQL
mret db backup --type postgres --db myapp --user admin
# MySQL
mret db backup --type mysql --host db.example.com --db production
# MongoDB
mret db backup --type mongo --host localhost --port 27017 --db myapp
Intelligent cleanup of merged branches with safety checks and remote synchronization.
Features:
# Clean local merged branches
mret git cleanup
# Include remote branches
mret git cleanup --remote
# Preview changes
mret git cleanup --dry-run
Interactive commit message builder following Conventional Commits specification.
Commit Types:
feat: New featuresfix: Bug fixesdocs: Documentation updatesstyle: Code style changesrefactor: Code refactoringperf: Performance improvementstest: Test additions or modificationschore: Maintenance tasksWorkflow:
mret git commit
# Interactive prompts for:
# 1. Commit type
# 2. Scope (optional)
# 3. Description
# 4. Body (optional)
# 5. Breaking changes flag
Automatic CHANGELOG.md generation from commit history with categorization and linking.
# Generate full changelog
mret changelog
# Between versions
mret changelog --from v1.0.0 --to v2.0.0
.gitignore ManagementTemplate-based .gitignore generation from gitignore.io with project type detection.
# Interactive selection
mret gitignore
# Specific templates
mret gitignore --templates node,vscode,macos
# List available
mret gitignore --list
Detailed bundle composition analysis with size tracking and budget enforcement.
Capabilities:
# Analyze bundle
mret bundle analyze
# Custom build command
mret bundle analyze --build-command "webpack --mode production"
# Size budget check
mret bundle check --max-size 500
# CI integration
mret bundle check --max-size 1000 || exit 1
Dockerfile analysis with best practice recommendations and security improvements.
Analysis Includes:
# Analyze Dockerfile
mret docker optimize
# Analyze specific file
mret docker optimize -f Dockerfile.prod
# Image size analysis
mret docker size
mret docker size myapp:latest
Visual representation of package dependency tree with circular dependency detection.
# Display graph
mret deps
# Save to file
mret deps --output dependencies.txt
Process identification and management for network ports.
# Check port availability
mret port check 3000
# Kill process on port
mret port kill 3000
# Find free port
mret port find
# Find in range
mret port find --start 8000 --end 9000
Encryption:
mret env encrypt [--file .env] [--output .env.encrypted]
Decryption:
mret env decrypt [--file .env.encrypted] [--output .env]
Temporary Viewing:
mret env view [--file .env.encrypted]
Environment Comparison:
mret env diff <file1> <file2>
Environment Switching:
mret env use <environment> # dev, staging, prod, etc.
Scan Project:
mret secrets scan [--path ./src] [--exclude node_modules,dist]
Output: Lists all detected secrets with:
Security Scan:
mret audit check [--level <low|moderate|high|critical>] [--production] [--json]
Interactive Fix:
mret audit fix [--force]
Outdated Packages:
mret audit outdated [--major] [--json]
Audit Licenses:
mret license [--allowed <comma-separated-licenses>]
Example:
mret license --allowed MIT,Apache-2.0,BSD-3-Clause,MIT
Add Command:
mret add <name> <command>
Remove Command:
mret remove <name>
List Commands:
mret list
Execute Command:
mret run <name> [args...]
Interactive Mode:
mret build-cmd
Category Filter:
mret build-cmd --category docker
Create:
mret alias create <name> <command>
List:
mret alias list
Remove:
mret alias remove <name>
Setup:
mret act setup
Run Workflow:
mret act run [workflow] [--job <job>] [--event <event>] [--dry-run]
List Workflows:
mret act list [--json]
Validate:
mret act validate
Check Coverage:
mret coverage [--threshold <percent>]
Install:
mret hooks install
Uninstall:
mret hooks uninstall
Deploy:
mret deploy [--provider <vercel|netlify|firebase>]
Profile Build:
mret profile <command>
Generate:
mret ssl generate [--domain <domain>] [--days <days>]
Backup:
mret db backup --type <postgres|mysql|mongo> [--host <host>] [--port <port>] [--db <database>] [--user <user>] [--output <path>]
Cleanup:
mret git cleanup [--remote] [--dry-run]
Conventional Commit:
mret git commit
Generate:
mret changelog [--from <tag>] [--to <tag>]
Generate:
mret gitignore [--templates <templates>] [--list]
Analyze:
mret bundle analyze [--build-command <cmd>] [--open]
Check Budget:
mret bundle check [--max-size <kb>]
Optimize:
mret docker optimize [-f <dockerfile>]
Size Analysis:
mret docker size [image]
Visualize:
mret deps [--output <file>]
Check:
mret port check <port>
Kill:
mret port kill <port>
Find Free:
mret port find [--start <port>] [--end <port>]
Run Fixes:
mret fix [--all]
Includes:
Setup:
mret config setup
Get/Set:
mret config get <key>
mret config set <key> <value>
mret config unset <key>
List:
mret config list
mret.config.jsDefine custom commands and workflows:
module.exports = {
// Simple string commands
test: 'npm test',
build: 'npm run build',
lint: 'eslint . --ext .ts,.tsx',
// Multi-step commands
deploy: 'npm run build && npm run test && firebase deploy',
// Platform-specific commands
'docker:build': 'docker build -t myapp:latest .',
'docker:run': 'docker run -p 3000:3000 myapp:latest',
// Function-based commands for complex logic
greet: async (...args) => {
console.log(`Hello, ${args.join(' ')}!`);
},
// Conditional commands
'deploy:prod': async () => {
const { execSync } = require('child_process');
if (process.env.NODE_ENV !== 'production') {
throw new Error('Must be in production environment');
}
execSync('npm run build && firebase deploy --only hosting:production');
}
};
.mretconfigManaged automatically by mret:
{
"firebase": {
"apiKey": "...",
"projectId": "..."
},
"aliases": {
"dp": "deploy --provider vercel",
"tc": "test && coverage"
},
"preferences": {
"defaultShell": "zsh",
"theme": "default"
}
}
Scenario: Large development team with strict security and compliance requirements.
Implementation:
# Initial setup
mret init
mret hooks install
mret completion install
# Security baseline
mret env encrypt
mret secrets scan
mret audit check --level high
mret license --allowed MIT,Apache-2.0
# Quality gates
mret coverage --threshold 90
mret bundle check --max-size 500
# CI/CD pipeline testing
mret act validate
mret act run ci
Scenario: Public repository requiring automated changelog and contribution guidelines.
Implementation:
# Setup contribution workflow
mret gitignore --templates node,vscode,macos
mret hooks install
# Generate documentation
mret changelog
mret license
# Quality checks
mret audit check
mret secrets scan
Scenario: Multiple services with independent deployment pipelines.
Implementation:
# Per-service commands in mret.config.js
module.exports = {
'service:user:build': 'cd services/user && npm run build',
'service:user:test': 'cd services/user && npm test',
'service:user:deploy': 'cd services/user && firebase deploy --only functions:user',
'service:api:build': 'cd services/api && npm run build',
'service:api:test': 'cd services/api && npm test',
'service:api:deploy': 'cd services/api && firebase deploy --only functions:api'
};
DO:
.env.dev, .env.prod)DON'T:
.env filesRecommended Workflow:
# Pre-commit
mret secrets scan
mret audit check --level high
# Pre-deployment
mret bundle check
mret coverage --threshold 80
mret license
GitHub Actions Example:
name: Quality Gates
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npm install -g mret
- run: mret secrets scan
- run: mret audit check --level moderate
- run: mret license --allowed MIT,Apache-2.0,MIT
- run: mret coverage --threshold 80
Recommended:
# Before commit
mret git commit # Use conventional commits
# Regular maintenance
mret git cleanup
# Release preparation
mret changelog
mret uses a modular architecture with independent command modules:
src/
├── commands/ # Command implementations
│ ├── security/ # Security-related commands
│ ├── testing/ # Testing and QA commands
│ ├── build/ # Build and deployment
│ └── git/ # Git utilities
├── utils/ # Shared utilities
│ ├── encryption.ts # Cryptography functions
│ ├── firebase.ts # Firebase integration
│ └── loader.ts # Configuration loading
└── index.ts # CLI entry point
Custom commands can be added via:
mret.config.jsmret alias createAlgorithm: AES-256-CBC
Key Derivation: PBKDF2
Iterations: 10,000
Salt Length: 16 bytes
IV Length: 16 bytes
Regular expression patterns for common secret types are maintained in src/commands/secrets.ts. Custom patterns can be added by extending the SECRET_PATTERNS array.
mret is built with privacy as a core principle:
What We DON'T Collect:
What Stays Local:
~/.mretconfig)Firebase Integration (Optional):
mret config setupmret world commandsmret world deletemret complies with major data protection regulations:
Full Details: See PRIVACY.md
Encryption:
Secret Detection:
Vulnerability Management:
Responsible Disclosure:
Command execution times (approximate):
| Command | Duration | Notes |
|---|---|---|
mret env encrypt | < 100ms | Depends on file size |
mret secrets scan | 1-3s | Depends on project size |
mret audit check | 2-5s | Network dependent |
mret bundle analyze | Varies | Depends on build time |
mret git cleanup | < 500ms | Local operation |
--exclude patterns for faster scanningContributions are welcome! Please follow these guidelines:
git clone https://github.com/yourusername/mret.git
cd mret
npm install
npm run build
npm link
npm test
npm run lint
git checkout -b feature/amazing-feature)git push origin feature/amazing-feature)MIT License - see LICENSE file for details.
Built with:
GitHub Repository • Report Issues • Privacy Policy • Security
Made with care for developers worldwide
FAQs
A meta-CLI tool for simplifying developer workflows
We found that mret demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.