npm
30 articles about npm in AI news
Why Your CLAUDE.md Needs a 'No npm install' Rule for Open Source Repos
Add a `# In open source repos, never run npm install or pip install without asking first` rule to CLAUDE.md. This prevents Claude Code from executing untrusted code, saving tokens and protecting your system.
TrapDoor supply-chain attack hits npm, PyPI, Crates.io — weaponizes AI config files
TrapDoor planted 34 malicious packages on npm, PyPI, and Crates.io, and injected poisoned AI config files into repos to weaponize Claude Code and Cursor.
Block Compromised NPM/PyPI Packages Automatically with attach-guard
A new Claude Code plugin uses PreToolUse hooks to automatically block compromised packages like the recent axios hijack before they install.
Axios NPM Package Under Active Supply Chain Attack, Potentially Impacts 100M+ Weekly Installs
The widely-used JavaScript HTTP client library Axios may be compromised via a malicious dependency in its latest release, exhibiting malware-like behavior including shell execution and artifact cleanup. With over 100 million weekly downloads, this represents a critical software supply chain threat.
Graft: Replace MCP Tool Calls with a Semantic Code Map That Cuts Agent
Install Graft via npm, run `graft init`, and Claude Code gets a persistent semantic map via hooks — cutting exploration tool calls and boosting SWE-bench Verified to 66%.
13,000+ MCP Servers Exist — Here's How to Find the Right One
MCP hit 13,000+ servers and 97M monthly SDK downloads. mcp-hub solves discovery with search and install commands. Install it now to stop guessing on npm.
How to Build and Publish an MCP Server
Build an MCP server in ~600 lines of TypeScript with @modelcontextprotocol/sdk, using the X syndication endpoint trick, and publish to npm, Anthropic Registry, and Glama for maximum AI tool discoverability.
mcp-hub: The CLI Tool That Fixes MCP Discovery — 13,000+ Servers, One Command
mcp-hub is a CLI tool that lets you search and install MCP servers from a verified registry — no more guessing on npm. With 13,000+ servers and 97M monthly SDK downloads, discovery is the bottleneck.
Run `is_change_safe` Before Your Agent Breaks an API
SpecShield MCP server adds a `is_change_safe` tool to Claude Code that checks OpenAPI diffs for breaking changes before your agent commits them. Install from npm or the MCP registry.
MCP Server Discovery: How to Find the Right Tool in a Sea of 13,000 Servers
With 13,000+ MCP servers available, discovery is the new bottleneck. Use `mcp-hub` or Smithery to find verified servers for Claude Code instead of searching npm blind.
Stop Telling Claude to 'Be Careful' — 3 Hook Tools That Fix What Prompts Can't
Throughline, Caveat, and Spotter are three npm tools that use Claude Code hooks to fix context bloat, past-trap memory, and missed tool calls — problems CLAUDE.md instructions can't solve.
Axios Supply Chain Attack Highlights AI-Powered Social Engineering Threat to Open Source
The recent Axios npm package supply chain attack was initiated by highly sophisticated social engineering targeting a developer. This incident signals a dangerous escalation in the targeting of open source infrastructure, where AI tools could amplify attacker capabilities.
Inside Claude Code’s Leaked Source: A 512,000-Line Blueprint for AI Agent Engineering
A misconfigured npm publish exposed ~512,000 lines of Claude Code's TypeScript source, detailing a production-ready AI agent system with background operation, long-horizon planning, and multi-agent orchestration. This leak provides an unprecedented look at how a leading AI company engineers complex agentic systems at scale.
Lorg CLI: The New Way to Give Claude Code a Permanent Memory
Lorg's new CLI tool lets Claude Code autonomously archive what it learns between sessions, eliminating knowledge loss with a simple npm install.
Claude Code Source Leak: What Developers Found and What It Means for You
Claude Code's source code was exposed via an npm source map. The leak reveals its MCP architecture and confirms it's a TypeScript wrapper, but doesn't change how you use it.
Scan MCP Servers Before You Install: New Free Tool Reveals Security Scores
A new free scanner lets you check any npm MCP server package for security risks like malicious install scripts before adding it to your Claude Code config.
Multi-Claude CLI: Switch Between Team and Personal Claude Code Accounts Instantly
A new npm package lets you manage multiple Claude CLI accounts with shared configs and cloud sync, perfect for switching between work and personal projects.
Bun 1.4's Bun.WebView: Build a Shot-Scraper-Style JSON API for Claude Code
Bun 1.4's Bun.WebView enables a 192-256MB browser automation JSON API (shot-scraper style). Use it to give Claude Code web scraping and JS execution without heavy Playwright overhead.
Test APIs Without Leaving Claude Code: API Dash MCP Server Adds Interactive UIs
Install API Dash MCP server via npx apidash-mcp@latest to let Claude Code execute HTTP requests and render interactive UIs, eliminating manual API testing context-switching.
Claude Code Now Supports AGENTS.md: The Cross-Agent Standard Is Here
Claude Code supports AGENTS.md (issue #6235). Use AGENTS.md for team-shared rules, CLAUDE.md for Claude-only tweaks. This keeps configs portable across Codex, Amp, and Cursor.
How to Build a Secure MCP Server for DynamoDB: The RiskAnalyzer Pattern
DynamoDB Sage shows how to secure MCP database access: a Go RiskAnalyzer validates tool calls, Kafka async writes prevent throttling, Prometheus tracks security events — apply this pattern to your Claude Code MCP servers.
Yardmaster: The Terminal That Makes Multiple Claude Code Sessions Actually
Yardmaster turns Claude Code sessions into named, grouped, hook-driven panes with token meters and worktree support. Install via Homebrew and reclaim control of parallel workflows.
7 CLAUDE.md Mistakes That Were Silently Taxing My Sessions (And the Exact Fixes)
Fix your CLAUDE.md workflow: move hard rules to PreToolUse hooks, target reads with grep, and delegate exploration to subagents to reclaim context. First sentence: The fix is moving hard rules to PreToolUse hooks and CLAUDE.md for preferences.
Claude Code 2.1.224 Drops 200-Subagent Cap: Scale Your Parallel Workflows Now
Claude Code 2.1.224 lifts the 200-subagent cap and adds cross-session SendMessage/ListAgents. Update now to run unlimited parallel agents and orchestrate multi-machine workflows.
Octopus Deploy's MCP Server: The Missing Onboarding Tool for Kubernetes Teams
Install Octopus Deploy's MCP server via `claude mcp add` to let Claude Code query environments, inspect releases, and trigger Kubernetes deployments—cutting onboarding friction and context-switching for ops teams.
stryker-mcp-reporter v1.13.0: AI Agents Hit 100% Mutation Score
stryker-mcp-reporter v1.13.0 adds an ESLint hook and lets AI agents run Stryker mutation tests to chase 100% mutation score. The claim lacks reproducible proof.
How to Test and Debug MCP Servers for Claude Code: A Production Guide
Unit-test tool logic, mock external services, and add integration tests for MCP servers. Claude Code's MCP integration demands observability beyond local demos.
Vercel Ships Shareable Skill Packs for Agent Workflows
Vercel launched shareable, unlisted skill packs on skills.sh with one-command install and GitHub repo support, standardizing agent workflows across teams.
MCP Workbench Beta: The Postman for MCP Servers Is Now Free to Use
MCP Workbench gives Claude Code users a browser-based GUI to debug MCP servers: paste a command, see tools, test calls, and verify protocol compliance. Try it free at mcp-workbench.uk.
Agent Plugins 1.0.0: The Portable Plugin Standard That Makes MCP Servers
Agent Plugins 1.0.0 standardizes MCP server packaging into portable plugins. Claude Code users can create a plugin.json manifest to share tools across ChatGPT, Cursor, Copilot, and more.