Perch is a semantic code linting tool that uses Jev to analyze code for defects. Users can install it via npm, configure it with a TypeSafe API key, and run scans to identify issues like wrong order, inverted conditions, and off-by-one errors with severity levels and confidence scores.
Shipledger is a tool that verifies release notes match actual git commits. It compares manually-written release notes against local git history without generating notes or calling GitHub. The demo shows a passing check for v0.2.0 and a failing check for v0.3.0 due to a missing commit reference.
Vibe Coding Production Kit (VCP) is a model-agnostic CLI and operating system for AI-assisted software development that structures vague coding workflows into repeatable engineering lifecycles with specifications, architecture, verification, security, and safe updates. It works with multiple coding agents including Claude Code and GitHub Copilot, requiring Node.js 22+ with no runtime dependencies.
issue-graph is a CLI tool that traces linked GitHub issues and pull requests to help developers find related work, competing changes, and unresolved follow-ups before starting work. It supports various output formats including terminal, Markdown, JSON, and interactive HTML exploration, with history tracking and agent integration capabilities.
Depglobe is a browser-based tool that visualizes the maintainers of a software repository's dependencies on an interactive 3D globe. It supports multiple package managers including npm, PyPI, Go, and Cargo, requiring no authentication token.
A malicious npm package impersonating mathjs contains an encrypted remote access implant that activates when a specific equation is solved. The loader uses the matrix data as a decryption key to reveal and execute a payload that accepts attacker commands via chat services and blockchain networks. Similar implants were found in two other copycat packages on npm.
Jev-Leftpad is an npm package that left-pads strings using an AI model (Jev) via TypeSafe's API instead of JavaScript's built-in padStart(). It supports padding up to 10 spaces, requires Node.js 20+, and is intended as a humorous demonstration rather than production code.
A malicious npm campaign distributing the 'indexed-btree' package and nine related libraries bypasses GitHub's 2026 supply chain defenses by hiding malware in runtime code execution rather than installation scripts. The malware collects system information and uses Ethereum smart contracts for command-and-control, with the campaign achieving millions of downloads across affected packages.
Openmsg is a tool enabling inter-agent communication between different AI coding platforms (Claude, Codex, OpenCode) running simultaneously on one or multiple machines. Version 0.2 supports secure end-to-end encrypted messaging between two people across machines, with cryptographic identity verification and fine-grained access controls ensuring agents only receive authorized messages within their projects.
TanStack supply-chain attack in May 2026 compromised an NPM package repository, leading to unauthorized access of approximately 170 private CrowdSec GitHub repositories by a BreachForum member on May 22nd. CrowdSec discovered and responded to the incident starting September 16th with credential rotation and forensic investigation, finding that while private code was exposed, the primary risk concerned any embedded credentials that required immediate deprecation.