
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
mob-tool
Advanced tools
mobtMob-Tool is a command-line tool designed to facilitate mob programming sessions for remote teams. The tool provides several features to help teams manage their sessions, including controlling the timer, switching the driver role among team members, and simplifying the necessary Git commands to hand over the work to the next team member.
Mob programming is a software development approach where a team of developers works together on the same task at the same time.
main branch: All changes are made in a new feature branch, and you can choose the
name of the branch when you start the mob session.pip install mob-tool
Important!
Please note that some operating systems might be equipped with the
python3andpip3commands instead ofpythonandpip(but they should be equivalent). If you don’t havepiporpip3available in your system, please check out pip installation docs.
To start a new session, use the following command:
mobt start <branch-name>
Here's an example of the output of the start command:

When your time is up, pass the driver role to the next team member with the following command:
mobt next
Here's an example of the output of the next command:

Note that you must call mob next even if you didn't make any changes in the code, so the Mob-Tool can manage whose
turn is next.
The next driver (in this example, Erik) can start working by running the same mobt start <branch-name> command.
When your feature is ready, you can end the session with the following command:
mobt done
This will squash all the commits and push all the changes to the remote. All Git hooks will be executed for this final
commit. The hooks are always ignored during the start and next commands.
Here's an example of the output of the done command:

To set up the development environment, follow these steps:
python -m venv venv.pip install -e .e.g.:
rm -rfv venv
python -m venv venv
source ./venv/bin/activate
pip install -e .
If one of the Git commands fails, all changes made to the repository are rolled back. Here's an example of the output with a rollback in action:

FAQs
Mob session management tool
We found that mob-tool demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.