
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
pr-reviewer
Advanced tools
A CLI tool for automated code review and PR description generation using LLM (Language Learning Model). This tool analyzes Git diffs, structures the changes, and leverages AI to provide insightful code reviews and PR descriptions.
Set up your OpenAI API key as an environment variable:
# Linux/macOS
export OPEN_API_KEY=your_openai_api_key
# Windows (Command Prompt)
set OPEN_API_KEY=your_openai_api_key
# Windows (PowerShell)
$env:OPEN_API_KEY="your_openai_api_key"
npm install commander winston
npm install -g .
pr-reviewer [options]
Options:
-V, --version output version number
-b, --branch <branch> branch name to review (required)
-m, --mode <mode> review mode (review/description) (default: "review")
-t, --target-branch <branch> target branch to compare against (default: "development")
-v, --verbose enable verbose logging
-o, --output <output> output folder (default: "tmp")
-h, --help display help for command
# Basic review of a feature branch
pr-reviewer -b feature/new-feature
# Generate detailed description comparing against main branch
pr-reviewer -b feature/new-feature -m description -t main
# Review with verbose logging
pr-reviewer -b feature/new-feature -v
# Show help
pr-reviewer --help
review (default)
description
brief
The tool generates several output files:
combined.log: Complete execution logerror.log: Error-specific loggingInitialization
Git Operations
Diff Processing
LLM Integration
Cleanup
The tool includes comprehensive error handling for:
Errors are:
pr-reviewer/
├── src/
│ ├── GitOperations.js
│ ├── DiffParser.js
│ ├── PRReviewer.js
│ ├── LLMAdapter.js
│ └── send_to_llm.js
├── logs/
│ ├── combined.log
│ └── error.log
└── package.json
Common issues and solutions:
Git access errors
API key issues
Parsing errors
The tool uses customizable prompts for different review modes. These prompts can be modified by editing the MODE_FOR_PROMPT.js file in the project root.
// prompts.js
module.exports = {
PROMPTS: {
review: `[Your custom review prompt]`,
brief: `[Your custom brief prompt]`,
description: `[Your custom description prompt]`,
},
};
To modify the prompts:
MODE_FOR_PROMPT.js in the project rootPROMPTS object// prompts.js
module.exports = {
PROMPTS: {
review: `
As a senior developer, review this code focusing on:
- Performance implications
- Security concerns
- Best practices
- Potential edge cases
Please be constructive and specific.
`,
brief: `
Provide a 2-3 sentence summary of the changes.
Include:
- Main purpose 🎯
- Key technical changes 🔧
- Impact on users 👥
`,
description: `
Create a comprehensive PR description with:
1. Overview of changes
2. Technical implementation details
3. Testing considerations
4. Visual diagrams where applicable
`,
},
};
To add a new review mode:
Add your new prompt to the PROMPTS object:
module.exports = {
PROMPTS: {
// Existing prompts...
newMode: `Your new prompt here`,
},
};
Use the new mode:
pr-reviewer -b feature/branch -m newMode
MIT License - see LICENSE.md for details
For bugs and feature requests, please create an issue in the repository.
Note: This tool is in active development. Please report any issues or suggestions for improvement.
# Increment version
npm version patch|minor|major
# Publish
npm publish
FAQs
CLI tool for automated PR reviews using LLM
The npm package pr-reviewer receives a total of 31 weekly downloads. As such, pr-reviewer popularity was classified as not popular.
We found that pr-reviewer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.