
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
SKU: TR-200, filed under Technical Reports (TR).
A machine information report by SHAUGHNESSY V DEVELOPMENT INC. (originally from United States Graphics Company)
"Machine Report" is similar to Neofetch, but very basic. It's a bash script (or PowerShell on Windows) that's linked in the user's login startup script (.bashrc, .zshrc, or PowerShell profile); it displays useful machine information right in the terminal session. The report automatically displays when a user logs in, opens a new terminal, or SSHs into the machine. See installation instructions below.
This version includes major enhancements:
uninstall command removes all configurations‼️*** WARNING ***‼️
Alpha release, only compatible with Debian systems with ZFS root partition running as root user. This is not ready for public use at all.
✅ This fork is stable and tested on:
Since it is a bash script, you've got the source code. Just modify that for your needs. No need for any abstractions, directly edit the code. No modules, no DSL, no config files, none of it. Single file for easy deployment. Only abstraction that's acceptable is variables at the top of the script to customize the system, but it should stay minimal.
Problem with providing tools with a silver spoon is that you kill the creativity of the users. Remember MySpace? Let people customize the hell out of it and share it. Central theme as you'll see is this:
ENCOURAGE USERS TO DIRECTLY EDIT THE SOURCE
When you build a templating engine, a config file, a bunch of switches, etc; it adds 1) bloat 2) complexity 3) limits customization because by definition, customization template engine is going to be less featureful than the source code itself. So let the users just edit the source. Keep it well organized.
Another consideration is to avoid abstracting the source code at the expense of direct 1:1 readability. For e.g., the section "Machine Report" at the end of the bash script prints the output using printf—a whole bunch load of printf statements. There is no need to add loops or functions returning functions. What you see is roughly what will print. 1:1 mapping is important here for visual ID.
Tabular, short, clear and concise. The tool's job is to inform the user of the current state of the system they are logging in or are operating. No emojis (except for the one used as a warning sign). No colors (as default, might add an option to add colors).
lscpu (usually pre-installed)lastlog2 (modern Debian/Raspberry Pi OS) OR lastlog (legacy systems)If your system is different, things might break. Look up the offending line and you can try to fix it for your specific system.
The easiest way to install TR-200 on any platform:
npm install -g tr200
Run on-demand:
tr200
# or
report
Set up auto-run on terminal startup:
tr200 --install
Remove auto-run:
tr200 --uninstall
Completely uninstall:
tr200 --uninstall
npm uninstall -g tr200
Requirements: Node.js 14.0.0 or later
| Command | Description |
|---|---|
tr200 | Run the machine report |
tr200 --help | Show help |
tr200 --version | Show version |
tr200 --install | Set up auto-run on terminal startup |
tr200 --uninstall | Remove auto-run configuration |
For users without Node.js:
cd ~/git-projects && gh repo clone RealEmmettS/usgc-machine-report && \
cd RealEmmettS-usgc-machine-report && ./install.sh
The install.sh script handles everything: OS detection, dependency installation, backup, configuration, and auto-run setup.
Prefer not to touch the terminal? Download the pre-packaged zip (hosted soon at a friendly URL like https://…/tr-200-machine-report.zip), extract it anywhere, and double-click one of these launchers inside the extracted folder:
| Platform | Launcher | What it does |
|---|---|---|
| Windows | install_windows.exe | Runs the PowerShell installer via the bundled ps2exe executable so it works from Explorer |
| macOS | install_mac.command | Opens Terminal automatically and runs install.sh with full macOS detection |
| Linux (Debian/Ubuntu/Arch/Fedora/etc.) | install_linux.sh | Finds your terminal emulator, launches it, and runs install.sh with all the existing distro detection |
Each launcher simply calls the same install.sh/install_windows.ps1 logic already in this repo, so you get identical results without typing commands manually. Keep the extracted directory structure intact so the launchers can find the scripts.
Maintainers can regenerate the bundle with:
./tools/package_release.sh
The script creates dist/tr-200-machine-report.zip containing the launchers, machine_report.sh, documentation, and the latest Windows assets. If pwsh + ps2exe are available it also builds install_windows.exe automatically; otherwise it leaves the PowerShell installer in place with a warning so you can build the executable later on Windows.
Ask Claude Code:
npm install -g tr200 && tr200 --install
For login sessions over ssh, reference the script ~/.machine_report.sh in your .bashrc file. Make sure the script is executable by running chmod +x ~/.machine_report.sh.
Copy machine_report.sh from this repository and add it to ~/.machine_report.sh ('.' for hidden file if you wish). Reference it in your .bashrc file as follows:
# This is your .bashrc file.
# Add the following lines anywhere in the file.
# Machine Report alias - run anytime with 'report' command
alias report='~/.machine_report.sh'
# Run Machine Report only when in interactive mode
if [[ $- == *i* ]]; then
~/.machine_report.sh
fi
Once installed, you can run the machine report anytime with:
report
Or directly:
~/.machine_report.sh
Automatic display: Machine Report will automatically appear when you open a new terminal or SSH into the machine.
Following the project's philosophy, directly edit the source to customize:
nano ~/.machine_report.sh
Common customizations:
report_title - Change the header textzfs_filesystem - Set your ZFS pool name| System | Architecture | Filesystem | Bash | Status |
|---|---|---|---|---|
| Raspberry Pi OS (Trixie) | ARM64 | ext4 | 5.x | ✅ Tested |
| macOS Sonoma/Ventura | ARM64/x86_64 | APFS | 4.0+ | ✅ Full Support |
| macOS (default Bash 3.2) | ARM64/x86_64 | APFS | 3.2 | ⚠️ Works with warnings |
| Debian 13 (Trixie) | x86_64 | ext4/ZFS | 5.x | ✅ Working |
| Debian 12 (Bookworm) | x86_64 | ext4/ZFS | 5.x | ✅ Working |
| Ubuntu 24.04+ | x86_64 | ext4/ZFS | 5.x | ✅ Should work |
| Fedora/RHEL 9 | x86_64 | ext4/xfs/btrfs | 5.x | ✅ Should work |
| Arch/Manjaro | x86_64 | ext4/btrfs | 5.x | ✅ Should work |
| Alpine Linux | x86_64 | ext4 | varies | ⚠️ May need tweaks |
| BSD (FreeBSD/OpenBSD) | x86_64 | UFS/ZFS | varies | ⚠️ Partial support |
Solution: Install lastlog2 package:
sudo apt install -y lastlog2
This fork automatically handles both lastlog2 (modern) and lastlog (legacy).
This is normal on some ARM systems where CPU frequency isn't exposed via /proc/cpuinfo. The script continues to work normally.
Edit ~/.machine_report.sh and modify:
root_partition="/" to your desired partitionFor ZFS systems, edit:
zfs_filesystem="zroot/ROOT/os" to your pool nameNew CLI Flags + PowerShell Compatibility
--install flag: Set up auto-run on terminal startup via npm--uninstall flag: Remove auto-run configuration cleanly--help flag: Show usage information (all scripts)--version flag: Show version information (all scripts)[System.Net.Dns]::GetHostName() and null-conditional operators--install promoted as primary installation methodUpgrade path:
npm update -g tr200
tr200 --install # Re-run to update shell config if needed
Complete Rebrand + Auto-Run Enhancements + npm Publishing
npm install -g tr200
tr200 (https://www.npmjs.com/package/tr200)tr200 and report work globally after npm installuninstall Command: Clean removal of all configurations on all platforms.profile/.zprofile$HOME\TR200 instead of $HOME\TR100npm Packaging Details:
bin/tr200.js) detects OS and spawns bash/PowerShellmachine_report.sh, WINDOWS/TR-200-MachineReport.ps1child_process.spawn() with stdio: 'inherit')Breaking Changes:
TR100 to TR200Show-TR100Report to Show-TR200Reportuninstall first, then reinstallTested On:
Cross-Platform Compatibility Release
sysctl, vm_stat, scutil integrationcommand_exists, file_readable, is_ipv4Breaking Changes: None - fully backward compatible
Tested On:
lastlog2 support for modern Debian systemslastlog2 and lastlogreport alias for convenient on-demand executionThis project is maintained by ES Development LLC (https://emmetts.dev).
For the original upstream project, see: usgraphics/usgc-machine-report
Feel free to:
BSD 3 Clause License. Copyright 2026, ES Development LLC (https://emmetts.dev). See LICENSE file for license information.
Based on original work by U.S. Graphics, LLC.
FAQs
Cross-platform system information report with Unicode box-drawing display
The npm package tr200 receives a total of 1 weekly downloads. As such, tr200 popularity was classified as not popular.
We found that tr200 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.