
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@aadithya2112/pcode
Advanced tools
A lightweight coding agent prototype built with Bun that uses an orchestrator pattern to expose tools to an LLM (OpenRouter). The agent can read, write, search, and execute code while being guided by an AI model to accomplish tasks.
npm install -g @aadithya2112/pcode
After installation, the pcode command will be available globally.
Get your free API key from OpenRouter.
Option 1: Global config (recommended)
mkdir -p ~/.config/pcode
echo '{"OPENROUTER_API_KEY":"your-api-key-here"}' > ~/.config/pcode/config.json
Option 2: Environment variable
export OPENROUTER_API_KEY=your-api-key-here
Add to your ~/.zshrc or ~/.bashrc to make it permanent.
Option 3: Local .env file
echo "OPENROUTER_API_KEY=your-api-key-here" > .env
bun install.env.example to .env and add your OpenRouter API keypcode "Create a TypeScript file that exports sayHello function"
After completing the task, the agent will ask: "Anything else you'd like me to do?"
pcode --interactive
Then type your tasks:
> Create a file src/hello.ts
> Read the file and show me
> exit
pcode -p /path/to/project "Build the TypeScript project"
bun run scripts/scenario.ts
createFile - Create a new file with contentreadFile - Read file contents (with optional line ranges)editFile - Replace text in a filedeleteFile - Delete a filelistDirectory - List files in a directorysearchInFiles - Search for patterns in filesrunCommand - Execute shell commands (whitelisted)getFileInfo - Get file metadataappendToFile - Append content to end of filegitStatus - Get git statusgetDiff - Get git diffgetEnvVar - Read environment variablesEnvironment variables in .env:
OPENROUTER_API_KEY (required) - Your OpenRouter API keyLLM_MODEL (optional) - Model to use (default: mistralai/mistral-7b-instruct:free)mistralai/mistral-7b-instruct:free (recommended)meta-llama/llama-2-7b-chat:freeopenrouter/autonpm, git, node, bunrm, sudo, chmod, reboot, etc.# Create a TypeScript project structure
bun run src/cli.ts "Create a TypeScript project with src/, dist/, and package.json"
# Add documentation
bun run src/cli.ts "Create a detailed README.md for my project"
# Search and modify
bun run src/cli.ts "Search for all TODOs in the codebase and show me what needs to be fixed"
# Build and test
bun run src/cli.ts "Build the project with npm and show me any errors"
coding-agent-cli/
├── .env # API keys (GITIGNORED)
├── .env.example # Template for .env
├── README.md # This file
├── package.json
├── tsconfig.json
├── PLAN.md # Detailed implementation plan
├── src/
│ ├── types.ts # TypeScript interfaces
│ ├── cli.ts # Entry point
│ ├── orchestrator.ts # Main orchestration loop
│ ├── tools/
│ │ ├── registry.ts # Tool definitions & schemas
│ │ └── executor.ts # Tool implementations
│ └── llm/
│ └── client.ts # OpenRouter LLM client
├── scripts/
│ └── scenario.ts # Example scenario
└── tests/
└── (future tests)
User Task
↓
CLI (parse args, load env)
↓
Orchestrator (initialize)
↓
LLM Client (send to OpenRouter with tools)
↓
LLM Response (with tool_calls)
↓
Tool Executor (validate + execute)
↓
Tool Results
↓
LLM Client (send back for next iteration)
↓
Repeat until done
↓
Final Response → User
# Run CLI with task
bun run src/cli.ts "Your task here"
# Interactive mode
bun run src/cli.ts --interactive
# Run scenario example
bun run scripts/scenario.ts
# Type checking (built into bun)
bun check
src/types.ts (TOOL_NAMES enum)src/tools/registry.tssrc/tools/executor.tsMake sure you've created a .env file with your API key:
cp .env.example .env
# Edit .env and add your key
The command you tried to run is blocked for safety. Check src/types.ts for allowed commands.
File operations are restricted to:
Check:
MIT
FAQs
A coding agent CLI powered by Claude
We found that @aadithya2112/pcode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.