
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Scan your projects and automatically detect the tools you're using. Update your StackShare tech stack without manual effort.
Beta - The StackShare CLI is currently in beta. Features may change and we'd love your feedback!
npx stackshare scan
This scans your current directory and detects tools automatically. No installation required.
For frequent use, install globally:
npm install -g stackshare
# or
pnpm add -g stackshare
The CLI maintains a curated database of 4,600+ tools across 71 StackShare categories, each with specific detection patterns:
tailwind.config.js, .eslintrc, docker-compose.yml)package.json, pyproject.toml, etc.This approach detects more than just npm packages—it finds Vercel, GitHub Actions, Docker, Tailwind CSS, and hundreds of other tools across all categories.
stackshare scan [directory] # Scan a directory for tools (default command)
stackshare login [api-key] # Authenticate with StackShare
stackshare logout # Remove stored authentication
stackshare scan [directory] [options]
Options:
-s, --stack <slug> Sync to an existing stack by slug
-S, --stack-name <n> Stack name for new stacks
-a, --all Include all detected tools (not just primary)
-n, --dry-run Scan only, do not post
-j, --json Output JSON only
-v, --verbose Show matched files for each tool
-y, --yes Skip prompts, post automatically
-r, --raw Show all detections without deduplication
$ stackshare scan
✔ Scanned 847 files in 234ms
Detected 18 primary tools (24 total):
▸ Application & Data
● TypeScript · Languages
● React · JavaScript Frameworks
● Next.js · Frameworks (Full Stack)
● Tailwind CSS · Front-End Frameworks
▸ DevOps
● Docker · Virtual Machine Platforms
● GitHub Actions · Continuous Integration
▸ Utilities
● ESLint · Code Review
● Prettier · Code Review
● Vitest · Testing Frameworks
? What would you like to do? › Post on StackShare
When posting, the CLI opens a browser window for you to sign in. After authenticating, your API key is saved automatically.
Authenticate directly with an API key:
stackshare login <your-api-key>
Generate an API key from your account settings.
For automated pipelines, set the STACKSHARE_API_KEY environment variable:
export STACKSHARE_API_KEY=your-key-here
npx stackshare scan --yes --stack my-project
Add automatic stack updates to your CI/CD pipeline:
# .github/workflows/update-stack.yml
name: Update StackShare
on:
push:
branches: [main]
paths:
- 'package.json'
- 'pnpm-lock.yaml'
- '*.config.*'
- 'Dockerfile'
jobs:
update-stack:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npx stackshare scan --yes --stack my-project
env:
STACKSHARE_API_KEY: ${{ secrets.STACKSHARE_API_KEY }}
See the CI/CD Integration guide for GitLab CI, CircleCI, and Azure Pipelines examples.
The scanner identifies tools across all StackShare categories:
Full documentation available at stackshare.io/docs/cli
Email team@stackshare.io for bug reports, feature requests, or to request new tool detection.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.