
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
openspec-stat
Advanced tools
Track team members' OpenSpec proposals and code changes in Git repositories
English | 简体中文
A CLI tool for tracking team members' OpenSpec proposals and code changes in Git repositories.
# global install
npm install -g openspec-stat
# or local (dev dependency)
npm install -D openspec-stat
Default window: yesterday 20:00 → today 20:00.
# basic run
openspec-stat
# custom time range
openspec-stat --since "2024-01-01 00:00:00" --until "2024-01-31 23:59:59"
# multi-repo (uses config)
openspec-stat multi -c .openspec-stats.multi.json
openspec-stat --help)-r, --repo <path>: repository path (default: current directory)-b, --branches <list>: comma-separated branches, supports wildcards-s, --since <datetime> / -u, --until <datetime>: time window-a, --author <name>: filter by author-c, --config <path>: config file--json | --csv | --markdown: output format-l, --lang <language>: en or zh-CN-v, --verbose: verbose outputAnalyze multiple local/remote repositories in one run.
openspec-stat init --multi # interactive setup
openspec-stat multi -c .openspec-stats.multi.json # aggregated view
openspec-stat multi -c .openspec-stats.multi.json --show-contributors
See Multi-Repository Guide for full details.
Remote cache: remote repos are cloned once and reused under
~/.openspec-stat/cached/repos/<repo-name>-<hash>. Use --cache-mode temporary
to force one-off clones, or --force-clone to refresh a single run.
Create .openspec-stats.json or openspec-stats.config.json in the repo root.
{
"defaultBranches": ["origin/master", "origin/main", "origin/release/*"],
"defaultSinceHours": -30,
"defaultUntilHours": 18,
"authorMapping": {"john.doe@company.com": "John Doe"},
"openspecDir": "openspec/",
"excludeExtensions": [".md", ".txt", ".png", ".jpg", "..."],
"activeUserWeeks": 2
}
Key fields: default branches/time window, author mapping (merge identities), OpenSpec directory, excluded extensions, active user window.
📊 OpenSpec Report
Time: 2024-01-01 00:00:00 ~ 2024-01-31 23:59:59
Branches: origin/master
Total Commits: 8
Proposal Summary
┌──────────────┬─────────┬───────────┬───────────┐
│ Proposal │ Commits │ Files │ Net Δ │
├──────────────┼─────────┼───────────┼───────────┤
│ feature-123 │ 5 │ 30 │ +656 │
└──────────────┴─────────┴───────────┴───────────┘
Author Summary
┌─────────┬─────────┬───────────┬───────────┐
│ Author │ Commits │ Proposals │ Net Δ │
├─────────┼─────────┼───────────┼───────────┤
│ John D. │ 8 │ 3 │ +667 │
└─────────┴─────────┴───────────┴───────────┘
Use --markdown, --json, or --csv for other formats.
--lang en (default) or --lang zh-CN. Locale-based auto-detection is also supported.
pnpm install
pnpm dev
pnpm build
node dist/cjs/cli.js
MIT
FAQs
Track team members' OpenSpec proposals and code changes in Git repositories
We found that openspec-stat demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.