DEV Community: Aarav Maloo

cmdutils available to download via winget

Aarav Maloo — Fri, 31 Jul 2026 16:09:26 +0000

Excited to share that cmdutils is now downloadable via winget! 🚀

cmdutils is a zero-bloat CLI tool written in pure Rust that provides everyday utilities like image conversion, compression, metadata extraction, and more.

It follows a clean structure: each category is a "subnet" (like image), and each command inside is a "util" (convert, compress, resize, etc).

It's still early and pretty basic, but I plan to extend it significantly over time.

I already maintain a Homebrew tap for macOS users, and now it's live on winget for Windows. AUR support is next on the roadmap.

Would love for you to check it out and share any feedback!
Github 🔗: https://github.com/aaravmaloo/cmdutils

Publishing APM@v11.0.0

Aarav Maloo — Wed, 29 Jul 2026 15:32:21 +0000

APM v11.0.0 is finally live. This one took 4 months, and most of that time was spent undoing my own decisions.

Here's the honest version of how this release went.

I spent 3 months building a full GUI for APM, on top of the existing CLI. Somewhere in there I realised maintaining both at once was more than I could sustain, so I shelved the GUI entirely.

Around the same time, I decided to port the whole codebase to Rust. The reason was oddly specific: FaceID was too slow. Instead of asking why it was slow, I jumped straight to a full rewrite.

Turns out the real fix was much simpler. I didn't need a custom FaceID framework at all. The OS already has native biometric authentication that's faster, better tested, and more secure than anything I could build myself. So I ripped my framework out completely and switched to that instead.

By the time I realized all this, I'd made enough changes that I couldn't touch the codebase without something breaking. I had to stop, sit with it, and slowly work my way back to something stable. That's really what this release is: 4 months of course correction, finally shipped.

What's actually in v11.0.0:

Removed:

Custom FaceID framework, completely, replaced by OS-native biometric auth
vocab, it never fit what APM was supposed to do
brutetest, unused and not worth keeping
audit, replaced by a much stronger command below

Added:

Native TouchID support on macOS
lgit, a proper mini-git for your vault. Supports signing, log view, and options audit never had
cleanup, a command that scans your vault for unused, deprecated, or unrecognized entries and asks permission before fixing them
Automatic vault repair. If APM detects a corrupted or outdated vault while decrypting, it now offers to fix it right there instead of failing silently

Also made APM installable using homebrew. Next is AUR on the package manager checklist.

If there's one thing I'm taking from this release, it's that removing the wrong decision is sometimes more valuable than shipping the next feature. Half of v11.0.0 is things I took out, not things I added, and the tool is better for it.

🔗 Full changelog: https://lnkd.in/dwAtkgrS

buildinpublic #opensource #passwordmanager

Shipping blob v1.3.0

Aarav Maloo — Wed, 29 Jul 2026 15:29:53 +0000

Shipped v1.3.0 of blob, my terminal note manager written in C 🚀.

The main thing I wanted to fix this release: plugin keybind conflicts were annoying. If two plugins wanted the same key, you had to manually dig through configs to fix it.

Now it's built into the plugin manager itself. See a [key conflict] tag, hit ENTER, and an interactive flow lets you assign a new key right there. No separate helper plugin required anymore.

Also added:
→ Undo (u) for destructive actions like trash, delete, rename
→ A full keybinding editor (Ctrl+K) for every keybind in the app
→ An auto-save plugin for notes
→ Expanded help views (Ctrl+O, Ctrl+M) so you can actually see what every key does

blob is zero-dependency, has its own plugin system, and is available to download via homebrew (I maintain my own tap), winget, and AUR.

Still building this solo alongside a couple other projects, learning a ton about plugin architecture design along the way.

buildinpublic #opensource #c

I'm now a maintainer of toofan, here's what I shipped

Aarav Maloo — Sun, 26 Jul 2026 13:43:23 +0000

toofan is Monkeytype, but for your terminal. Minimal, lightweight, zero telemetry, everything stays local. It's sitting at 300+ stars and was recently featured on Terminal Trove.

I recently became a maintainer, and wanted to write up what I've contributed so far and what I learned building it.

PR #50: Multiplayer support
toofan was singleplayer-only until now. I reached out to Amit (vyrx-dev), the creator and owner, and he was on board with adding multiplayer, as long as it didn't compromise the core philosophy of the project: minimal, fast, and local-first.

Here's how it works:
** Protocol and hosting **
I used an SSE-based protocol and self-hosted the server myself, listening on port 8525.

** Server logic (Go) **
When a player joins a room, the server tracks it. Once enough players have joined based on what the host selected, the match starts automatically.

** Anti-cheat **
The server owns and distributes the word list for every race. Clients never generate or supply their own words, this closes off the obvious vector for injecting an easier list to fake a high WPM.

** Client integration **
Wired all of this into the existing toofan TUI so multiplayer feels native, not bolted on.

** AI ghost racers (also in PR #50) **
When no one's online, you can race bots instead. Their progress renders as ghost carets on your screen in real time, and you can race against multiple bots simultaneously, not capped at one.

** PR #51: Storage consolidation **
Consolidated how race results were being stored into a more efficient format. This closed an issue Amit had opened himself (#55).

** PR #52: Race your past self **
Every race gets logged to a single races.txt. A ghost caret renders your previous attempt alongside your current one, so you can literally race your own growth over time and see if you're actually improving.

** What I learned: **
Contributing to toofan pushed me into a few areas I hadn't gone deep on before:
Real-time networking (SSE, connection handling, race-state sync)
Self-hosting and running a small always-on server
UX design for a TUI, this is a different medium than web, spacing and real-time feedback matter a lot more
Maintaining someone else's philosophy for a project while still shipping meaningful features

Planning to stay on as a long-term contributor. If you're into terminal tools, Go, or just want to race your friends at typing, check it out: repo link

blob - A minimal notes manager written in C

Aarav Maloo — Sun, 19 Jul 2026 13:41:16 +0000

I built blob, a minimal, keyboard-driven note manager that lives inline in your terminal — not a fullscreen TUI app, just a fast selector that gets out of your way the moment you're done.

Some of what's under the hood:

~2,600 lines of pure C11, zero runtime dependencies
Full note lifecycle: create, rename, search, trash/restore, and permanent delete, all with live search and relative timestamps
A command palette and a real plugin system — plugins declare their own API version, permissions, and run mode, and blob checks compatibility and warns on conflicts before loading them
11 built-in plugins so far: encryption (lock), git-sync, tagging, fuzzy search, stats, pin, archive, export to HTML/PDF/DOCX, timed reminders, and more
A cross-platform Makefile (Linux/macOS/Windows via MinGW) with a proper test suite
Packaged and shipping through real distribution channels — AUR (yay -S blob-bin) and winget (winget install aaravmaloo.blob), on top of GitHub Releases

Blob is extendable using plugins. Each plugin uses a manifest (v2) that defines the permissions it needs and blob, at runtime compiles the plugin's code and stores the binary in its directory. That binary is then used to run that plugin independently.

The hardest part wasn't the note-taking logic; it was designing the plugin architecture so third-party plugins can't silently do anything dangerous, and getting the packaging right for two completely different platform ecosystems.

Repository: GitHub
AUR package: AUR page
Winget PR: PR

Releasing revera@1.0.0

Aarav Maloo — Sat, 18 Jul 2026 11:10:37 +0000

Today I launched revera@1.0.0, upgrading from 0.1.0 to stable.
revera is a CLI that scores npm packages for security risk before you install them. The 1.0.0 rewrite replaces fixed weights with a Bayesian evidence engine: every package becomes a node in its dependency graph, gets scored across 8 categories from real signals (vuln feeds, publisher trust, GitHub activity, typosquat detection), and risk propagates bottom-up through the whole dependency tree, not just the top-level package.
Previously it used pre-defined weights. Now it decides its own weights from the evidence.
npm install revera

I made revera, a tool that scores NPM packages before you blindly install them

Aarav Maloo — Sun, 05 Jul 2026 18:22:06 +0000

Ever installed an npm package without really knowing what you were pulling into your project? I did too, and it bugged me enough that I built Revera.
Revera scores any npm package using a weighted algorithm across maintainability, trust signals, release history, download trends, and more, giving you a single, explainable score before you npm install blindly.
Some of the features I'm proud of:

🔍 why breaks down exactly why a package scored the way it did
🩺 doctor checks that your setup is healthy
⚡ 24h local caching for speed
🔐 GitHub login for higher rate limits
⚙️ Fully customizable scoring config
📂 audit scans your working directory and scores everything at once

It's still evolving, though, the algorithm isn't perfect yet, but it's getting close, and every bit of feedback (good or brutal) helps me improve it.
Would genuinely love for you to try it out:
📦 npm: https://www.npmjs.com/package/@aaravmaloo/revera
💻 GitHub: https://github.com/aaravmaloo/revera