
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
CLI tool to install BMAD workflow files into any project with integrated Shai-Hulud 2.0 security scanning
A command-line tool to set up BMAD (Business Model and Architecture Design) workflow files in your project.
npm install -g tops-bmad
npx tops-bmad
The BMAD package zip file is encrypted for security. Before distributing the package, you need to encrypt it:
npm run encrypt-zip
This will:
bmad-package.zip filebmad-package.zip.backupImportant: Keep the secret key secure and share it only with authorized users who need to install the BMAD package.
To verify that the encrypted file can be decrypted correctly:
npm run test-decryption
This test script will:
This is useful for verifying that encryption/decryption works correctly before distribution.
Navigate to your project directory
Run the BMAD CLI:
npx tops-bmad
Enter the secret key when prompted (the password used to encrypt the package)
Enter your project name when prompted
The tool will:
After installation, your project will include:
.your-project/
├── .bmad/ # BMAD configuration and templates
└── .cursor/rules/ # Cursor IDE rules and workflow commands
├── bmad/ # BMAD-specific rules
├── ba-workflow-init-command.mdc
├── dev-workflow-init-command.mdc
└── qa-workflow-init-command.mdc
To update to the latest version:
npm update -g tops-bmad
Contributions are welcome! Please open an issue or submit a pull request.
MIT
FAQs
CLI tool to install BMAD workflow files into any project with integrated Shai-Hulud 2.0 security scanning
The npm package tops-bmad receives a total of 23 weekly downloads. As such, tops-bmad popularity was classified as not popular.
We found that tops-bmad demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.