
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@circleci/agents
Advanced tools
A simple toolkit for CircleCI agents, including tools for analyzing and fixing flaky tests and automating pull request workflows.
pnpm install
pnpm build
This script analyzes CircleCI test failures and suggests (and can apply) fixes for flaky tests.
pnpm cli fix-flaky-tests --git-url https://github.com/circleci-petri/quality-agent-target.git
you will have to setup in the target workspace the expected flaky test api output - url to fetch it would look something like this:
https://circleci.com/api/v2/insights/github/circleci-petri/quality-agent-target/flaky-tests
Environment variables required:
GITHUB_TOKEN (GitHub personal access token for PR creation and private repo access)ANTHROPIC_API_KEY (Anthropic Claude API key) -OR-OPENAI_API_KEY (OpenAI API key for Codex fallback)Optional environment variables:
CCI_AGENT_OPENAI_MODEL (OpenAI model to use, defaults to 'o3')To deploy and test the canary version of the flaky tests pipeline:
pipeline-definitionsfix-flaky-tests pipeline definitionfile_path parameter in the request body to:
"file_path": "circleci-agents/configs/fix-flaky-tests/canary.yml"
After completing the above steps, triggering the pipeline using the "Fix Flaky Tests" button will now use the canary configuration instead of the standard one.
testing rollbar functionality locally:
pnpm cli report-fix-flaky-tests
This should make a failed to run error in rollbar.
FAQs
CircleCI AI Agents
The npm package @circleci/agents receives a total of 28 weekly downloads. As such, @circleci/agents popularity was classified as not popular.
We found that @circleci/agents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 84 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.