
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
A NodeJS based CLI tool for doing useful things against the Guru KB (https://getguru.com)
Note: This tool is an open source project that is not officially supported by Guru. Use at your own risk.
This tool was made by us at Pliancy to augment the Guru administration experience. We hope it's useful to others as well!
It currently provides the following features:

The NPM method is preferred since it is consistent across operating systems. The homebrew method is for convienence only.
Install Node JS 14 or greater if you do not already have it from the Offical NodeJS Download Page
npm install -g guru-cli
# or
yarn global add guru-cli
brew install pliancy/tap/guru-cli
$ guru-cli login
Login to Guru API
-------------------
Guru Admin Email: example@company.com
Admin API Token: some-api-token
✅ Successfully authenticated to Guru API. You can now run guru-cli commands.
Now you're ready!
Many commands support a powerful filtering syntax with regex support. The filtering supports a familiar google-style query syntax of key:value where key is one of collection, board, title, or content and value is any ECMAScript supported regular expression. Typically you can just fuzzy match via something like title:Overview which logically means title contains the substring "Overview". See below for more examples of using this filtering.
If you need to ignore case sensitivity in the supplied regex you can pass the --ignore-case or -i flag to the command.
guru-cli find 'title:Typescript|Javascript collection:Engineering'
guru-cli find 'content:Caleb.*great guy'
guru-cli verify-by-title 'card title'
guru-cli verify-by-title --collection 'collection title' 'card title'
guru-cli verify-expired
guru-cli verify-expired 'collection:Engineering title:Overview'
guru-cli find-replace -i 'G Suite' 'Google Workspace'
Once you're confident in your changes affecting the proper data in the preview:
guru-cli find-replace -i 'G Suite' 'Google Workspace' --confirm
This one is a bit more complex because it uses a regex feature known as negitive look-ahead in the filter to accomplish filtering out the relevant cards
guru-cli find-replace 'Archer' 'Lana' 'content:"^(?!.*this is how you get ants)"'
Once you're confident in your changes affecting the proper data in the preview:
guru-cli find-replace 'Archer' 'Lana' 'content:"^(?!.*this is how you get ants)"' --confirm
guru-cli backup-cards /path/to/some/folder
FAQs
CLI tools for Guru KB (getguru.com)
The npm package guru-cli receives a total of 2 weekly downloads. As such, guru-cli popularity was classified as not popular.
We found that guru-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.