A developer released a tool that sandboxes the install step of any NPM package, fetching the exact tarball npm install would and running declared install scripts in a sandbox with no network, dropped …
Michael Hannecke built a sovereign coding agent on macOS, running Pi in an Apple container with zero NPM dependencies on the host system. The setup isolates the agent's runtime, ensuring a clean host …
Writemark is a dependency-free inline Markdown editor that renders as users type, keeping raw Markdown as the underlying value for storage and submission. The web component, built by Brostoffed, offer…
Developer Brostoffed released Writemark, a dependency-free web component for inline Markdown editing that renders Markdown while writing and supports source, split, and preview modes, slash commands, …
Guard-AI, a new security linter from developer Karthik VK, automatically catches AI-generated code vulnerabilities such as hallucinated dependencies, hardcoded secret placeholders, and truncated code …
A developer built Guardian Engineering Framework (GEF), an open-source project generator that integrates engineering rules, AI prompts, and CI/CD directly into new projects to prevent AI assistants fr…
The author of the FastMCP Node.js framework is seeking help from someone at GitHub or the NPM team to rename the unused npm package 'vite-mcp' to 'vitemcp', after being denied by support due to securi…
A cybersecurity startup founder published seven typosquatted AI-tool packages on NPM that steal git, SSH, and cloud credentials via install scripts, accumulating about 20,000 downloads. The packages i…
A developer released a hobby plugin that connects the Pi coding agent with Signal, allowing users to send Note-to-Self messages from their phone or desktop for processing and receiving replies. The pl…
The Motion Mind Team has launched LibPilot, an AI-powered search engine and discovery hub for NPM packages. It indexes over 4,000,000 packages in real time, offering intent-based discovery, continuous…
Hextrap launched a package firewall that proxies pip, npm, go get, and cargo installs through managed allow/deny lists, OPA policies, and safeguards like soak time and typosquatting detection. The too…
Developer Alex Astrum migrated a Node.js CLI tool for managing Agent Skills to Go in one day using Antigravity 2.0, an AI-powered tool that automated code translation and test generation. The resultin…
A new malware campaign dubbed 'Miasma' is spreading through IDE configuration settings, AI-assisted environments, and multiple package manager ecosystems, marking what researchers believe is the first…