
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@claudeautopm/plugin-core
Advanced tools
Core framework functionality for ClaudeAutoPM - universal agents, rules, hooks, and utilities
Core framework functionality for ClaudeAutoPM
Version: 2.0.0 Category: Core Framework Size: ~8 KB (gzipped) Status: ✅ Required (always installed)
This is the core framework plugin that provides essential functionality for ClaudeAutoPM. It includes universal agents, rules, hooks, and utilities that apply to ALL projects regardless of technology stack.
This plugin is REQUIRED and is automatically installed with ClaudeAutoPM.
Core agents for framework functionality:
Framework utility commands:
Universal rules that apply to all projects:
Critical Priority:
tdd.enforcement - Enforce Test-Driven Development (Red-Green-Refactor)context7-enforcement - Enforce Context7 documentation queriesframework-path-rules - Path convention enforcementgolden-rules - Core framework principlessecurity-checklist - Universal security standardsHigh Priority:
agent-coordination - Agent orchestration patternsagent-mandatory - Agent usage requirementscommand-pipelines - Command orchestrationdevelopment-workflow - Universal development workflowgit-strategy - Git workflow and branchingdefinition-of-done - Quality standardspipeline-mandatory - Pipeline enforcementMedium Priority:
ai-integration-patterns - AI integration best practicescontext-optimization - Context management strategiesdevelopment-environments - Environment setupnaming-conventions - Naming standardsno-pr-workflow - Alternative git workflowperformance-guidelines - Performance optimizationstandard-patterns - Universal coding patternsLow Priority:
datetime - Date/time handling conventionsfrontmatter-operations - Frontmatter parsingstrip-frontmatter - Frontmatter utilitiesuse-ast-grep - AST parsing utilitiesEnforcement hooks for framework behavior:
Context7 Enforcement:
pre-command-context7.js - Enforce Context7 queries before command execution (BLOCKING)pre-agent-context7.js - Enforce Context7 queries before agent invocation (BLOCKING)unified-context7-enforcement.sh - Unified Context7 wrappercontext7-reminder.md - Context7 reminder textAgent Enforcement:
enforce-agents.js + .sh - Enforce agent usage over direct tool calls (BLOCKING)strict-enforce-agents.sh - Stricter agent enforcement (BLOCKING)Testing:
test-hook.sh - Hook testing utilityFramework utilities and libraries:
lib/ - Shared Libraries (5 scripts):
datetime-utils.sh - Date and time utilitiesfrontmatter-utils.sh - Markdown frontmatter parsinggithub-utils.sh - GitHub API utilitieslogging-utils.sh - Logging utilitiesvalidation-utils.sh - Validation utilitiesmcp/ - MCP Management (5 scripts):
add.sh - Add MCP serverenable.sh - Enable MCP serverdisable.sh - Disable MCP serverlist.sh - List MCP serverssync.sh - Sync MCP configurationThis plugin is automatically installed with ClaudeAutoPM. No manual installation needed.
# When you install ClaudeAutoPM:
npm install -g claudeautopm
autopm init
# plugin-core is automatically included
Always enabled - Enforces Test-Driven Development:
# Enforced by: rules/tdd.enforcement.md
Always enabled - Enforces Context7 documentation queries:
# Enforced by:
# - rules/context7-enforcement.md
# - hooks/pre-command-context7.js
# - hooks/pre-agent-context7.js
Always enabled - Agent orchestration and coordination:
# Enforced by: rules/agent-coordination.md
Always enabled - MCP server management utilities:
# Provided by: scripts/mcp/*.sh
# Invoke agents directly
@agent-manager create a new specialized agent for GraphQL
@code-analyzer review recent changes for bugs
@test-runner execute full test suite with analysis
@file-analyzer summarize large-log-file.log
# Process CodeRabbit reviews
/code-rabbit
# Handle complex prompts
/prompt
# Reinitialize framework
/re-init
# Use utility libraries (sourced by other scripts)
source .claude/scripts/lib/github-utils.sh
source .claude/scripts/lib/logging-utils.sh
# MCP management
bash .claude/scripts/mcp/add.sh context7
bash .claude/scripts/mcp/list.sh
bash .claude/scripts/mcp/sync.sh
None - this is the base plugin.
All other plugins depend on plugin-core:
@claudeautopm/plugin-pm - PM workflows@claudeautopm/plugin-devops - DevOps automation@claudeautopm/plugin-cloud - Cloud infrastructure@claudeautopm/plugin-frameworks - Frontend frameworks@claudeautopm/plugin-databases - Databases@claudeautopm/plugin-languages - Programming languages@claudeautopm/plugin-data - Data engineeringNo configuration needed - all core features are always enabled.
MIT
Part of ClaudeAutoPM v3.0.0 Plugin Architecture
FAQs
Core framework functionality for ClaudeAutoPM - universal agents, rules, hooks, and utilities
We found that @claudeautopm/plugin-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.