
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
openpkg-cli
Advanced tools
Command-line interface for producing OpenPkg specs from TypeScript projects.
# npm
npm install -g openpkg-cli
# bun
bun add -g openpkg-cli
# yarn
yarn global add openpkg-cli
# pnpm
pnpm add -g openpkg-cli
# Generate openpkg.json for the current package
openpkg generate
# Target a specific entry file
openpkg generate src/index.ts
# Scaffold an OpenPkg config
openpkg init
openpkg generate discovers the package manifest, figures out the correct entry point, resolves external .d.ts files when node_modules is present, and writes openpkg.json by default.
openpkg initCreate a starter openpkg.config file in the current project. The CLI picks an extension automatically:
openpkg.config.js when the nearest package.json declares { "type": "module" }openpkg.config.mjs otherwise (compatible with both ESM and CommonJS projects)openpkg init --cwd . --format auto
Options:
--cwd <dir> – Directory where the config should be created (defaults to current directory).--format <auto|mjs|js|cjs> – Override the generated file extension.The command aborts when a config already exists anywhere up the directory tree.
openpkg generate [entry]Generate an OpenPkg spec from a file or package entry point.
openpkg generate src/index.ts --output lib/openpkg.json --include=createUser
Key behaviors:
[entry] is omitted (using exports, main, or TypeScript config fields).openpkg.config.* defaults and then applies CLI flags on top.openpkg.json (or the path supplied via --output).[entry] – Entry file to analyze. Optional when the package exposes a single entry point.-o, --output <file> – Output path (default: openpkg.json).-p, --package <name> – Resolve and analyze a workspace package by name.--cwd <dir> – Base directory for resolution (default: current directory).--no-external-types – Skip pulling types from node_modules.--include <ids> – Keep only the listed export identifiers (comma-separated or repeatable).--exclude <ids> – Drop the listed export identifiers.-y, --yes – Assume "yes" for prompts.Create an openpkg.config.ts, .js, or .mjs file anywhere above your working directory to keep reusable defaults. Prefer .mjs/.cjs if you are running the CLI under Node.js without a TypeScript loader.
// openpkg.config.mjs
import { defineConfig } from 'openpkg-cli/config';
export default defineConfig({
include: ['createUser', 'deleteUser'],
exclude: ['internalHelper'],
resolveExternalTypes: true,
});
The CLI searches the current directory and its parents for the first config file and merges those settings with flags provided on the command line. defineConfig helps with type-safety but is optional—you can export a plain object as well.
include: string[] – Export identifiers to keep.exclude: string[] – Export identifiers to drop.resolveExternalTypes?: boolean – Override automatic detection of external type resolution.CLI flags always win over config values. When both provide filters, the CLI prints a short summary of how the sets were combined.
--include narrows the spec to the identifiers you care about. Any referenced types that fall outside the allow-list are removed unless they are still referenced.--exclude is useful for dropping experimental or internal APIs while keeping everything else.Supply --package <name> from the workspace root to locate a child package automatically. The CLI understands npm, pnpm, yarn, and bun workspace layouts.
openpkg generate --package @myorg/transactions
After a successful run the CLI prints:
The JSON schema for the output lives at schemas/v0.1.0/openpkg.schema.json in this repository.
MIT
FAQs
OpenAPI-like specification generator for TypeScript packages
The npm package openpkg-cli receives a total of 0 weekly downloads. As such, openpkg-cli popularity was classified as not popular.
We found that openpkg-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.