
Research
/Security News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.
mtd-helpThis module provides an easy way to define a help track for applications using mtd.
Using npm.
$ npm install mtd-help
A simple example.
// simple.js
'use strict';
const Depot = require('mtd');
const help = require('mtd-help');
new Depot()
.default('help', [], help(
{ name: 'Help Example',
hide: false },
{ foo: 'A line about foo.',
bar: 'A line about bar.',
help: 'Display this message.' }
))
.track(
'foo',
[
{ $: 'zal', alias: 'z', info: 'A description for zal.' },
{ $: 'qux', _: 'hello, world', alias: 'q', info: 'A description for qux.' }
],
(zal, qux) => console.log(zal, qux)
)
.track(
'bar',
[ { $: 'baz', alias: 'b', info: 'A description for baz.' } ],
baz => console.log(baz)
)
.embark();
Running our example application either as $ node simple.js or verbosely as $ node simple.js help will print the following to our terminal, complete with pretty colours.
Help Example
[ Multiple: On ][ Reruns: Off ][ Warnings: On ]
[ bar ] A line about bar.
--baz, -b
A description for baz.
[ foo ] A line about foo.
--zal, -z
A description for zal.
--qux, -q (default: hello, world)
A description for qux.
[ help ] (default) Display this message.
Require the module, as you would any other Node module.
const help = require('mtd-help');
help is now a factory function that creates a suitable Track block. It has the following signature.
factory (
settings: HelpSettings,
descriptions: GenericObject = {}
): Block
HelpSettings is an interface that looks like:
interface HelpSettings {
/*
* The name of your application,
* displayed at the top of the help print out.
*/
name: string;
/*
* Whether to list the track that is
* associated with the block generated
* in the final output.
*/
hide: boolean;
}
descriptions is a GenericObject:
interface GenericObject extends Object {
[index: string]: any;
}
Its keys should be strings, corresponding to Track handles in your application. Each value should be a description of the matching track.
Enjoy!
FAQs
A helpful Track.
We found that mtd-help demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Research
/Security News
Docker and Socket have uncovered malicious Checkmarx KICS images and suspicious code extension releases in a broader supply chain compromise.

Product
Stay on top of alert changes with filtered subscriptions, batched summaries, and notification routing built for triage.