
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
🚀 Unified App Store Deployment CLI — upload, metadata, release for iOS App Store & Google Play
🚀 Unified App Store Deployment CLI — iOS App Store & Google Play from your terminal
One CLI to upload builds, sync metadata, check review status, and release to production on both iOS App Store and Google Play.
npm install -g storeforge
# 1. Setup credentials
storeforge init
# 2. Upload your build
storeforge upload ios ./build/MyApp.ipa
storeforge upload android ./build/app-release.aab
# 3. Check status
storeforge status
# 4. Release to production
storeforge release ios
storeforge release android production
storeforge initInteractive setup wizard to configure App Store Connect and Google Play credentials.
storeforge init
storeforge uploadUpload binaries to app stores.
# Upload IPA to App Store Connect / TestFlight
storeforge upload ios <ipa-path>
# Upload AAB to Google Play (default: internal track)
storeforge upload android <aab-path>
storeforge upload android <aab-path> --track beta
storeforge upload android <aab-path> --track production
Options:
-t, --track <track> — Target track for Android: internal, alpha, beta, production (default: internal)storeforge metadataManage app metadata across both stores using YAML files.
# Sync local YAML to both stores
storeforge metadata sync metadata.yml
storeforge metadata sync metadata.yml --locale ja
# Pull current metadata from stores
storeforge metadata pull
storeforge metadata pull -o my-metadata.yml
Options:
--ios-app-id <id> — App Store Connect app ID--locale <locale> — Target locale (default: en-US)-o, --output <path> — Output path for pull (default: metadata.yml)storeforge statusCheck app review and processing status on both stores.
storeforge status
storeforge status --ios-app-id 1234567890
storeforge releasePromote builds from testing to production.
# iOS: Submit for App Store review
storeforge release ios
storeforge release ios --app-id 1234567890
# Android: Promote build through tracks
storeforge release android # Auto-detect next track
storeforge release android production # Promote to production
storeforge release android beta # Promote to beta
storeforge configManage credentials and configuration.
# Show current config
storeforge config list
# Set individual values
storeforge config set apple.keyId YOUR_KEY_ID
storeforge config set apple.issuerId YOUR_ISSUER_ID
storeforge config set apple.privateKeyPath /path/to/AuthKey.p8
storeforge config set google.serviceAccountPath /path/to/service-account.json
storeforge config set google.packageName com.example.myapp
# Get a value
storeforge config get google.packageName
.p8 private key file (you can only download it once!)storeforge config set apple.issuerId "your-issuer-id"
storeforge config set apple.keyId "your-key-id"
storeforge config set apple.privateKeyPath "/path/to/AuthKey_XXXXX.p8"
storeforge config set google.serviceAccountPath "/path/to/service-account.json"
storeforge config set google.packageName "com.example.myapp"
Store your app metadata in a version-controlled YAML file:
ios:
en-US:
title: "My Awesome App"
subtitle: "Do amazing things"
description: |
My Awesome App helps you do amazing things.
Features:
- Feature one
- Feature two
- Feature three
keywords:
- awesome
- productivity
- tools
whatsNew: |
- Bug fixes and performance improvements
- New feature X
android:
en-US:
title: "My Awesome App"
shortDescription: "Do amazing things with one tap"
description: |
My Awesome App helps you do amazing things.
Features:
★ Feature one
★ Feature two
★ Feature three
name: Deploy to Stores
on:
release:
types: [published]
jobs:
deploy:
runs-on: macos-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
- name: Install StoreForge
run: npm install -g storeforge
- name: Configure credentials
run: |
storeforge config set apple.issuerId "${{ secrets.ASC_ISSUER_ID }}"
storeforge config set apple.keyId "${{ secrets.ASC_KEY_ID }}"
echo "${{ secrets.ASC_PRIVATE_KEY }}" > /tmp/AuthKey.p8
storeforge config set apple.privateKeyPath /tmp/AuthKey.p8
echo '${{ secrets.GOOGLE_SERVICE_ACCOUNT }}' > /tmp/sa.json
storeforge config set google.serviceAccountPath /tmp/sa.json
storeforge config set google.packageName com.example.myapp
- name: Upload iOS
run: storeforge upload ios ./build/MyApp.ipa
- name: Upload Android
run: storeforge upload android ./build/app-release.aab --track beta
- name: Sync metadata
run: storeforge metadata sync metadata.yml
- name: Check status
run: storeforge status
Configuration is stored at ~/.storeforge/config.json:
{
"apple": {
"issuerId": "your-issuer-id",
"keyId": "your-key-id",
"privateKeyPath": "/path/to/AuthKey.p8"
},
"google": {
"serviceAccountPath": "/path/to/service-account.json",
"packageName": "com.example.myapp"
}
}
MIT © magicpro97
FAQs
🚀 Unified App Store Deployment CLI — upload, metadata, release for iOS App Store & Google Play
We found that storeforge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.