
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@funish/basis
Advanced tools
A modern development toolkit with unified CLI for package management, versioning, publishing, code quality, and Git workflow automation.
A modern development toolkit with unified CLI for package management, versioning, publishing, code quality, and Git workflow automation.
🧑💻 Contributing? See the monorepo documentation for development setup and contribution guidelines.
Basis is your unified development toolkit for modern projects. Instead of juggling multiple CLI tools, Basis provides a single interface for all your development workflow needs.
Similar to: Vite+ - Basis follows the same philosophy of unified tooling with Rust-powered components (oxlint/oxfmt) for maximum performance.
# Install with npm
$ npm install -D @funish/basis
# Install with yarn
$ yarn add -D @funish/basis
# Install with pnpm
$ pnpm add -D @funish/basis
# Install globally (optional)
$ pnpm add -g @funish/basis
# Or use directly without installation
$ npx @funish/basis init
cd your-project
basis init
# Options
basis init --force # Overwrite existing configuration
basis init --skip-git-check # Skip git directory check
basis init --skip-install # Skip dependency installation
# This creates:
# ✅ basis.config.ts with Git hooks
# ✅ Git hooks setup (run 'basis git setup' to activate)
# Lint code
basis lint
# Format code
basis fmt
# Build project
basis build # Build with default config
basis build --cwd ./packages # Build specific directory
basis build --stub # Generate stub files
# Audit code quality
basis audit # Run all audits
basis audit --dependencies # Audit dependencies only
basis audit --structure # Audit structure only
basis audit --fix # Auto-fix issues
# Add dependencies
basis add lodash
basis add -D typescript
# Remove dependencies
basis remove lodash
# Execute package without installation
basis dlx prettier --write .
# Run package.json scripts
basis run dev
basis run build
# Run TypeScript/JavaScript files directly
basis run src/index.ts
basis run scripts/setup.js
# Semantic version increments
basis version patch # 1.0.0 → 1.0.1
basis version minor # 1.0.0 → 1.1.0
basis version major # 1.0.0 → 2.0.0
# Prerelease versions
basis version prerelease # 1.0.0 → 1.0.1-edge.0
basis version prerelease --preid beta # 1.0.0 → 1.0.1-beta.0
# Advanced prerelease
basis version premajor # 2.0.0-alpha.0
basis version preminor # 1.1.0-alpha.0
basis version prepatch # 1.0.1-alpha.0
# Specific version
basis version 2.0.0
# Publish with tag detection
basis publish # Auto-detect tag based on version
basis publish --tag beta # Custom tag
# With git operations
basis publish --git # Also create git tag and commit
# Setup Git hooks
basis git setup # Install hooks from config
# Check staged files
basis git staged
# Validate commit message
basis git lint-commit
# Git passthrough (all other git commands)
basis git status
basis git log --oneline
basis git branch -a
// basis.config.ts
import { defineBasisConfig } from "@funish/basis/config";
export default defineBasisConfig({
git: {
hooks: {
"pre-commit": "basis git staged",
"commit-msg": "basis git lint-commit",
},
staged: {
rules: {
// String: filenames auto-appended
"*.ts": "basis lint --fix",
"*.md": "basis fmt --write",
// Array: multiple commands
"*.{js,jsx}": ["basis lint --fix", "basis fmt --write"],
// Function: full control
"*.tsx": (files) => `basis lint --fix ${files.slice(0, 10).join(" ")}`,
},
},
},
audit: {
dependencies: {
outdated: true,
security: true,
},
},
});
Basis uses intelligent tag detection based on version:
latest + edgebeta + edge--tag to overrideFAQs
A modern development toolkit with unified CLI for package management, versioning, publishing, code quality, and Git workflow automation.
The npm package @funish/basis receives a total of 17 weekly downloads. As such, @funish/basis popularity was classified as not popular.
We found that @funish/basis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.