CrowdStrike Counter Adversary Operations identified a threat actor behind PhantomRaven, an LLM-generated information stealer distributed through typosquatted npm packages that use remote dynamic depen…
An analysis of 698 npm packages published for TypeSafe AI's Jev decision model in its first eleven days found that only 193 of the 520 that build their own Jev requests honour the TYPESAFE_BASE_URL va…
Opaline launched as a free, MIT-licensed open-source analytics tool for team Claude Code and Codex coding sessions, installable via the command `npx opaline@latest` or a global npm install. The tool i…
TypeScript 6.0's --allowImportingTsExtensions flag removes the compiler's prohibition on .ts extensions in import specifiers, eliminating the TS1479 error for monorepo setups that export TypeScript so…
NoRoles launched an MIT-licensed open-source tool that replaces corporate roles and titles with a permission list, letting AI agents act with exactly their person's permissions and requiring a human s…
David Zhang released jevgrep, a command-line tool that searches code repositories for coding agents, and its current repository reports a 28.6% reduction in coding-agent costs — from $7.62 to $5.44 ac…
Two MemTensor packages on npm and PyPI were replaced with backdoored versions carrying the sckit credential-stealing worm between 02:23 and 05:55 UTC on September 23, according to SafeDep's analysis, …
Stepgate, an MCP server released on Hacker News' Show HN, runs agent procedures written as YAML "stepfiles" and shows the calling agent one step at a time, advancing only when that step's gates pass. …
A developer released StackCircuit365, a free npm package that monitors GitHub and Vercel deployments for issues and can automatically roll back to the last verified healthy version. The tool offers th…
Kiln released v1 and open-sourced videowright, an MIT-licensed npm tool that generates launch videos from prompts inside Claude Code, after using it to produce its own launch video in 2 days of iterat…
A developer released BetterWebSearch MCP, an open-source Model Context Protocol server for web search, extraction and deep research that runs locally with no API key, account or cloud service, default…
A developer behind the Scenerok video tooling outlined when AI agents should author videos in VidScript, a declarative DSL, versus TypeScript via the public @scenerok/sdk, arguing both compile to the …
A developer building Chron, a local audit log for AI coding sessions, discovered that a single NUL byte in one of 73,526 imported events caused a 14,994-message hash chain to falsely report tampering.…
Reladraw, a new diagram language that lets users control element placement, was released on GitHub with an in-browser playground, an npm install option, and a skill for use with Claude and other agent…
A developer published a 20-line Python Stop hook for Claude Code that blocks the agent from ending its turn until a configured verification command (such as `npm test && npx tsc --noEmit`) passes, fee…
A developer shipped 113 commits across seven days in September 2026, including the MCP setup guide "Model Context Protocol for the One-Person Stack," and found that nine of ten printed npm package ver…
Researchers at Semgrep documented a supply-chain attack in which the sckit worm was embedded in legitimate MemTensor MemOS npm and PyPI packages, activating not at install time but when the affected P…
Malicious versions of MemTensor's MemOS memory framework for LLMs and AI agents appeared on npm and PyPI between 02:23 UTC and 05:55 UTC on September 23, 2026, carrying a cross-platform Go credential …
A developer built TestSlop, a tool that takes a code diff and finds a nearby alternative implementation—an "Evil Twin"—that behaves differently but still passes the same test suite, then reports the i…
The skills.sh registry reached one million agent skills and nearly 280 million installs in seven months, according to an analysis of aggregate registry data, after Anthropic introduced Agent Skills in…