It's totally public, for example, here are the stars for the Vue repository: https://github.com/vuejs/vue-cli/stargazers, or the stars by its primary author: https://github.com/yyx990803?tab=stars
In Starring your repo does not give you permission to spam mevuejs
vue-cli
JavaScript2016–2023
vuejs / vue-cli
vue-cli
🛠️ webpack-based tooling for Vue.js Development
21Distinct people
21Mentions
0Explicit recommenders
29.5KGitHub stars
What to know before exploring
What it is
🛠️ webpack-based tooling for Vue.js Development
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:28:18 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year21 dated mentions
Observed mentions: 2016-08-14 16:26:37 UTC to 2023-11-26 22:01:32 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 7 | 3 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Vue CLI
⚠️ Status
Vue CLI is now in maintenance mode. For new projects, please use create-vue to scaffold Vite-based projects. create-vue supports both Vue 2 and Vue 3.
Also refer to the Vue 3 Tooling Guide for the latest recommendations.
For information on migrating from Vue CLI to Vite:
Vue CLI -> Vite Migration Guide from VueSchool.io
Tools / Plugins that help with auto migration
Documentation
Docs are available at https://cli.vuejs.org/ - we are still working on refining it and contributions are welcome!
Contributing
Please see contributing guide.
License
MIT
Read the full README on GitHubWhat Hacker News says
7 sourcesThis issue was also widely discussed in vue-cli repo issues: https://github.com/vuejs/vue-cli/issues/7054
I keep a factual record of such incidents and their developments in a repo called github dramas: https://github.com/paradite/github-dramas
In Node-ipc supply chain attack: peacenotwarNote that the only vulnerable version was @vue/cli v5.0.2, which was intended to pin the version of node-ipc to v9.2.1 but accidentally allowed versions greater than that: https://github.com/vuejs/vue-cli/commit/37ef809c873f33c88ba7...
The mistake was fixed within 6 minutes: https://github.com/vuejs/vue-cli/commit/b0d931668e7e8450a285...
It looks like the malware version of @vue/cli has been downloaded a total of 170 times.[1] That's 0.13% of all downloads of that package this week. It's also important to note that @vue/cli has been deprecated for months. If you're making a new Vue project today[2] you'll use create-vue[3] which doesn't depend on node-ipc at all.
1. https://www.npmjs.com/package/@vue/cli?activeTab=versions
2. https://vuejs.org/guide/quick-start.html
3. https://github.com/vuejs/create-vue
In NPM package compromised by author: erases files on RU / BY computers on installNPM package deletes all files when detects Russian IP
22 points · Open discussion...and node-ipc has been version-locked[1] to a previous release by vue/cli-shared-utils, perhaps one of the more popular downstream consumers of the package.
[1] - https://github.com/vuejs/vue-cli/issues/7051
In Protestware: “peacenotwar” NPM package drops anti-war message on user's desktopSupply-chain attack against Russian/Belarusian users by node-ipc package
6 points · Open discussionVue-CLI might contain malware from a dependency
2 points · Open discussion