
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
wave-shell
Advanced tools
Welcome to Wave Shell, where every line of code is a powerful wave propelling you forward in your development journey. Just like the rhythmic and fluid nature of ocean waves, our CLI tool is designed to make your coding experience smooth, efficient, and energizing.
Wave Shell is more than just a name; it's a representation of the dynamic and seamless development experience we strive to provide. Imagine coding as effortlessly as riding the perfect wave—surfing through your projects with grace and power. Our CLI tool aims to bring that natural flow to your development process, ensuring you stay productive and energized in your daily work.
File system commands: Every command at src/commands/ will be a new registered command for you!
Parsed command lines arguments:: All arguments parsed beautifully (booleans, strings, numbers)
File Template: Create files passing dynamic variables to our .surf files!. Powered by Surfstar
bunx wave-shell-cli create
src/commands/hello.ts
import { WaveCommand } from "wave-shell";
export default {
description: 'Hello world command',
run: async ({ args, print }) => {
const { world } = args.namedArgs; //world parsed as a boolean
if (!world) {
return print.error("We expected --world to say the phrase 😓")
}
print.success("Hello World!")
}
} as WaveCommand
run method above ⬆wave hello --world
src/templates/hello-world.surf
Hello {{ person.name }}! I see that you are {{ years }} years old. Nice!
src/commands/hello-world.ts
import { WaveCommand } from "wave-shell";
import { join } from 'path';
function getFilePath() {
const templateFolder = join(import.meta.dir, '../templates');
return join(templateFolder, 'hello-world.surf');
}
export default {
run: async ({ compileTemplate }) => {
const filePath = getFilePath();
const result = await compileTemplate(filePath, {
person: { name: 'John' },
years: 32
});
Bun.write('hello.txt', result)
}
} as WaveCommand
FAQs
Unknown package
We found that wave-shell demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.