
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Tiny CLI to spin up projects fast—licenses, docs, DDD scaffolds, environments, i18n, dependencies, a mock server, and OpenAI-powered prompts. Built with ❤️ for smooth DX: spinners, progress bars, and sensible defaults.
--l · LICENSE.md--d · Documentation--ddd · DDD Structure--env · Environments--lo · Locales (i18n)--sh · Shared Layer--ipr · Root Helpers--deps · Vue + Ecosystem--s · JSON Server--ask · OpenAI--all · One-Shot Bootstrap--del · Clean Uppackage.json excerpt--l Create LICENSE.md (ISC/MIT) with author & year.--d Bootstrap docs/ with user-stories.md and a PlantUML diagram.--ddd DDD skeleton:
src/<feature>/{application,domain/model,infrastructure,presentation/{components,views}}.--env Generate .env.developer & .env.production and update .gitignore.--lo Create src/locales/en.json & src/locales/es.json (basic structure).--sh Create src/shared/ with infrastructure/ and presentation/{components,views}.--ipr Create root-level i18n.js, pinia.js, router.js.--deps Install Vue + ecosystem deps (auto-detect npm/yarn/pnpm/bun).--s Prepare server/ (JSON Server) with db.json, routes.json, start.sh.--ask OpenAI integration: save API key and ask questions (optional streaming).--all Do it all in one go (with a smooth progress bar).--del Clean up everything created by --all (or just specific parts).Global: --no-anim disables animations (CI-friendly).
Runtime: CommonJS. Node.js ≥ 16 (≥ 18 recommended).
--askNo global install required:
npx smbm --help
Or add locally:
npm i -D smbm
npx smbm --help
| Command | What it does | Key options | ||
|---|---|---|---|---|
--l | Create LICENSE.md | `--type ISC | MIT·--author "Your Name"·--year 2025·--out LICENSE.md·--force` | |
--d | Generate docs/ (user-stories.md, diagrama.puml) | --dir · --stories · --diagram · --force | ||
--ddd | Create DDD skeleton in src/ | <FeatureName> · --name · --base | ||
--env | Create .env.developer & .env.production, update .gitignore | `dev | pro | all·--dir·--force·--no-ignore` |
--lo | Create src/locales/{en,es}.json | --dir · --force | ||
--sh | Create src/shared/{infrastructure,presentation/{components,views}} | --base · --name · --force | ||
--ipr | Create root i18n.js, pinia.js, router.js | --force | ||
--s | Prepare server/ for json-server | --pm · --dir · --force · --no-install | ||
--deps | Install deps (Vue + ecosystem) | --pm · --dev · --batch · --verbose | ||
--ask | Save OpenAI key or ask a question | set "KEY" · --model · --stream | ||
--all | Full setup with progress bar | <FeatureName> · --deps · --pm · --skip-server … | ||
--del | Delete output from --all or targeted parts | many (see section) |
# DDD scaffolding
npx smbm --ddd auth
npx smbm --ddd --name users
npx smbm --ddd orders --base src/modules
# Environments
npx smbm --env
npx smbm --env pro --dir config
# Locales & Shared
npx smbm --lo
npx smbm --sh # creates src/shared/... (infra + presentation/{components,views})
# Root helpers
npx smbm --ipr # creates i18n.js, pinia.js, router.js in project root
# Mock server
npx smbm --s --pm pnpm
# Dependencies (Vue + ecosystem)
npx smbm --deps --pm pnpm --verbose
# Everything in one go (with progress bar)
npx smbm --all Hello --deps
# Clean up (everything created by --all)
npx smbm --del
npx smbm --del --ddd --name Hello
npx smbm --del --docs --sh --env
npx smbm --del --file src/tmp.txt --files dist,coverage
--l · LICENSE.mdnpx smbm --l [--type ISC|MIT] [--author "Your Name"] [--year 2025] [--out LICENSE.md] [--force]
--d · Documentationnpx smbm --d [--dir docs] [--stories user-stories.md] [--diagram diagrama.puml] [--force]
Creates:
docs/
user-stories.md
diagrama.puml
--ddd · DDD Structurenpx smbm --ddd [<FeatureName>] [--name <FeatureName>] [--base src]
Scaffold only (no files):
src/
<FeatureName>/
application/
domain/
model/
infrastructure/
presentation/
components/
views/
--env · Environmentsnpx smbm --env [dev|pro|all] [--dir .] [--force] [--no-ignore]
--dir (default .).--no-ignore.--lo · Locales (i18n)npx smbm --lo [--dir locales] [--force]
Default structure (under src/locales):
src/locales/
en.json // { app, nav, pages, actions }
es.json // { app, nav, pages, actions }
--sh · Shared Layernpx smbm --sh [--base src] [--name shared] [--force]
Creates:
src/shared/
infrastructure/
presentation/
components/
views/
--ipr · Root Helpersnpx smbm --ipr [--force]
Generates three root files:
i18n.js (imports src/locales/{en,es}.json)pinia.jsrouter.js (with minimal inline routes)--deps · Vue + Ecosystemnpx smbm --deps [--pm npm|yarn|pnpm|bun] [--dev] [--batch] [--verbose]
Installs:
vue-i18n@11, vue-router@4primevue, @primeuix/themes, primeicons, primeflexpinia, axiosjson-serverAuto-detects the package manager from lockfiles.
--s · JSON Servernpx smbm --s [--pm npm|yarn|pnpm|bun] [--dir server] [--force] [--no-install]
Creates:
server/
db.json
routes.json
start.sh
Run:
sh server/start.sh
# or:
npx json-server --watch server/db.json --routes server/routes.json
--ask · OpenAISave API key (stored outside the repo: ~/.smbm/config.json):
npx smbm --ask set "sk-..."
Ask (default model: gpt-4o-mini):
npx smbm --ask "What is DDD?"
Streaming:
npx smbm --ask "Summarize this…" --stream
Note: You need valid OpenAI billing/quota. You can also set
OPENAI_API_KEYas an environment variable.
--all · One-Shot Bootstrapnpx smbm --all <FeatureName> [--deps] [--pm npm|yarn|pnpm|bun] [--dev] [--batch] [--verbose] [--skip-server] [--no-ignore] [--base src] [--sharedName shared] [--docsDir docs] [--envDir .] [--serverDir server]
Orchestrates: license → docs → DDD → shared → locales → env → root helpers → (server) → (deps). Includes a smooth progress bar with friendly status updates.
--del · Clean UpRemove everything created by --all:
npx smbm --del
Targeted deletion:
npx smbm --del --ddd [--name <FeatureName>]
npx smbm --del --docs
npx smbm --del --sh
npx smbm --del --lo
npx smbm --del --env
npx smbm --del --ipr
npx smbm --del --s
npx smbm --del --l
Individual root files or any path(s):
npx smbm --del --i18n
npx smbm --del --pinia
npx smbm --del --router
npx smbm --del --file src/tmp.txt
npx smbm --del --files dist,coverage
Also uninstall deps that --all may have installed:
npx smbm --del --deps [--pm npm|yarn|pnpm|bun]
All operations use spinners and progress bars by default.
Turn them off with --no-anim (or set CI=true).
npm ERR! Git working directory not clean → commit/stash before npm version.'smbm' is not recognized → run with npx smbm ... or install locally (npm i -D smbm).start.sh → use Git Bash/WSL or run the json-server command directly..env*. If a key leaked, revoke & rotate immediately.package.json excerpt{
"type": "commonjs",
"bin": { "smbm": "src/cli.js" },
"files": ["src/**/*", "README.md", "LICENSE.md", "package.json"]
}
PRs are welcome! If you spot a bug or have an idea for a new command, open an issue. Psst… there might be a tiny easter egg hidden in the CLI. 💌
ISC — see LICENSE.md for details.
FAQs
CLI: --l crea LICENSE.md, --d crea docs/, --ddd genera estructura DDD
We found that smbm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.