
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@code-insights/cli
Advanced tools
Parse and sync AI coding sessions (Claude Code, Cursor, Codex, Copilot) to Firebase for analysis
Command-line tool that parses AI coding session history and provides terminal analytics. Optionally syncs to your own Firebase Firestore for the web dashboard.
Full documentation: docs.code-insights.app
npm install -g @code-insights/cli
Verify it works:
code-insights --version
code-insights initConfigure Code Insights with your data source preference and optional Firebase credentials.
# Quick setup — import directly from files (recommended)
code-insights init \
--from-json ~/Downloads/serviceAccountKey.json \
--web-config ~/Downloads/firebase-web-config.js
# Interactive setup — prompts for data source + credentials
code-insights init
Flags:
--from-json <path> — Path to the Firebase service account key (auto-sets data source to Firebase)--web-config <path> — Path to the Firebase web SDK config (JSON or JS snippet)During interactive setup, the CLI first asks for your preferred data source:
Configuration is stored in ~/.code-insights/config.json. Web config is stored separately in ~/.code-insights/web-config.json.
code-insights statsTerminal analytics for your AI coding sessions. Works without Firebase.
# Dashboard overview (default: last 7 days)
code-insights stats
# Cost breakdown by project and model
code-insights stats cost
# Per-project detail cards with sparklines
code-insights stats projects
# Today's sessions with time, cost, model details
code-insights stats today
# Model usage distribution and cost chart
code-insights stats models
Shared flags:
| Flag | Short | Description |
|---|---|---|
--local | Force local data source (no Firebase) | |
--remote | Force Firestore data source | |
--period <range> | Time range: 7d, 30d, 90d, or all (default: 7d) | |
--project <name> | -p | Scope to a specific project (fuzzy matching) |
--source <tool> | -s | Filter by source tool (e.g., claude-code, cursor) |
--no-sync | Skip auto-sync before displaying stats |
code-insights configView and manage CLI configuration.
# Show current configuration
code-insights config
# Set data source preference
code-insights config set-source local # Local-only mode
code-insights config set-source firebase # Firebase mode
code-insights connectGenerate a URL to connect the web dashboard to your Firebase.
code-insights connect
The URL includes your Firebase web config base64-encoded as a query parameter. Open it in a browser to connect the dashboard to your Firestore — no manual configuration needed.
code-insights openOpen the web dashboard in your browser.
# Open the dashboard
code-insights open
# Open filtered to the current project
code-insights open --project
If Firebase web config is set up, the URL includes your config for automatic connection.
code-insights syncSync sessions from all supported tools to Firestore.
# Sync new/modified sessions
code-insights sync
# Force re-sync all sessions
code-insights sync --force
# Preview what would be synced
code-insights sync --dry-run
# Sync specific project only
code-insights sync --project "my-project"
# Sync only from a specific tool
code-insights sync --source cursor
# Quiet mode (for hooks)
code-insights sync --quiet
# Regenerate titles for all sessions
code-insights sync --regenerate-titles
# Sync even when data source is set to local
code-insights sync --force-remote
Note: When data source is set to
local, sync shows a warning and exits. Use--force-remoteto override, or switch withconfig set-source firebase.
code-insights statusShow sync status, statistics, and data source preference.
code-insights status
Displays:
code-insights resetDelete all data from Firestore and reset local sync state.
# Interactive (asks for confirmation)
code-insights reset
# Skip confirmation
code-insights reset --confirm
Note: In local mode, this clears the local stats cache only. Firestore data is not affected.
code-insights install-hookInstall a Claude Code hook for automatic sync after each session.
code-insights install-hook
Note: In local mode, the hook is not installed (sync requires Firebase).
code-insights uninstall-hookRemove the automatic sync hook.
code-insights uninstall-hook
code-insights telemetryManage anonymous usage telemetry. Telemetry is opt-out and helps improve the CLI.
# Check telemetry status
code-insights telemetry status
# Disable telemetry
code-insights telemetry disable
# Re-enable telemetry
code-insights telemetry enable
No personally identifiable information is collected. See the telemetry documentation for details.
The CLI reads JSONL files from ~/.claude/projects/ which contain:
Each session is parsed to extract:
Sync state is tracked in ~/.code-insights/sync-state.json:
--force to bypass and re-sync everythingProject IDs are generated from git remote URLs when available:
Sessions are automatically titled based on:
See CONTRIBUTING.md for development setup, code style, and PR guidelines.
MIT License — see LICENSE for details.
FAQs
Turn your AI coding sessions into knowledge
The npm package @code-insights/cli receives a total of 513 weekly downloads. As such, @code-insights/cli popularity was classified as not popular.
We found that @code-insights/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.