Mikael Weiss released Penguin, an open-source TypeScript workflow builder that lets developers define their own software factory workflows with deterministic pauses and adapters, addressing flaws in e…
A developer detailed how AI autofix tools like GitHub Copilot can introduce subtle security vulnerabilities due to incomplete contextual understanding, citing the Snowflake breach as a case in point. …
A developer built a weekly launchd job that automatically distributes AI-learned skills from Claude Code's global skills folder into every local git repository, eliminating the need for manual copying…
Anthropic's Claude Code CLI fails on Windows when given multi-line prompts because the npm-installed claude.CMD batch shim truncates everything after the first newline, causing the agent to receive in…
A developer discovered that on Windows, a batch-file shim for Claude Code truncated multi-line prompts at the first newline, causing an agent harness to score 3/24 on a web-task eval. By pointing dire…
Hermenics has released DeepSeek Code, an open-source CLI designed for working with DeepSeek AI models in the terminal. Inspired by Claude Code and OpenAI's Codex, the tool is available via npm and bun…
Sol-Luna, an MCP server for OpenAI Codex, lets a supervising GPT-5.6 Sol agent delegate bounded implementation tasks to isolated GPT-5.6 Luna worker threads, with scope enforcement and verification. I…
Coding agents that install dependencies at machine speed make registry-side vulnerability checks and install blocking a critical choke point, according to Omniline's blog. The article argues that huma…
Yadda 3.0.0, a BDD library for JavaScript, was published to npm by its maintainer Stephen Cresswell, who used Claude Code with Opus 4.8 to modernize the codebase in about a day. The release removes ob…
Researchers at Phylum have identified a new npm supply chain worm, dubbed ChainDrop, that evades standard defenses by using a multi-stage attack chain. The worm spreads through malicious packages and …
CrawlForge MCP Server v5.0.0 addresses a critical SSRF vulnerability that allowed IP-literal URLs to bypass hostname-based guards, potentially exposing loopback, link-local, and cloud metadata endpoin…
GitHub has revoked npm granular access tokens' ability to bypass two-factor authentication for sensitive account, organization, and package management actions, closing a security gap. The announcement…
A USENIX Security study analyzing 16 popular code-generation models across over 500,000 code samples found that a measurable percentage of AI-suggested package names do not exist in public registries,…
A solo founder shipped 128 releases of an SDLC orchestrator for AI coding agents that never gained a single external user, then built a second product with 442 passing tests that broke in real use, ac…
Developer Dillon Mulroy released anti-slop, an open-source (MIT) plugin of opinionated Oxlint rules that reject low-evidence and low-signal TypeScript and JavaScript patterns, distributed via source a…
Socket, a supply-chain security scanner, flagged the npm package ai2rules-harness with a Supply Chain Security score of 64%, prompting its developer to discover that the package's postinstall script f…
A coding-agent security tool shipped by an unnamed developer was found to have three critical flaws, including a kill switch at `.claude/gate-off` that the agent could create without denial, allowing …
Porcupine, a terminal AI agent built for safe autonomy, has been released as an open-source tool on GitHub, requiring Node.js 22.19+ and installable via npm. It offers Ask, Normal, and Auto modes to l…
A developer built Recall, a local CLI that derives structured context from a repository and stores it inside the repository itself, aiming to eliminate the need for coding agents to rediscover the rep…
OpenAI will retire its Assistants API on 26 August 2026, a year after the announcement, forcing developers to migrate to the Responses API. A developer's analysis of npm download data shows that 99% o…