
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@developerz.ai/aitm
Advanced tools
Autonomous task orchestrator. Goal in, merged PRs out.
Give aitm a sentence, walk away, come back to a stack of merged pull requests.
It runs a Planner → Worker → Reviewer loop against a real repo using the
Vercel AI SDK and OpenRouter, and
ships the work as PR-sized commits with CI gating and review-comment handling
baked in.
💡 Spiritual successor to the (deprecated)
developerz-ai/claude-task-master— same idea, rebuilt on the AI SDK + OpenRouter: provider-agnostic, concurrent PR groups, MCP client support, smaller surface area.
npm install -g @developerz.ai/aitm
bun install -g @developerz.ai/aitm
deno install -A npm:@developerz.ai/aitm
The package is scoped; the installed command is just aitm.
export OPENROUTER_API_KEY=sk-or-...
cd path/to/your/repo
aitm start "add JWT auth to /login" --max-prs 3
aitm plans the goal into up to 3 PR-sized groups, opens a branch per group,
works through them in parallel, opens each PR, watches CI, addresses review
comments, and auto-merges. Want a human gate?
aitm start "migrate Mongo → Postgres" --no-automerge
# ... review the PR in your browser ...
aitm merge-pr
| Role | Responsibility |
|---|---|
| Orchestrator | Top-level agent; drives the run group-by-group |
| Planner | Goal in → ordered PR groups (each a list of tasks) out |
| Worker | One PR group in → commits + an opened PR out |
| Reviewer | Review comments in → follow-up commits out |
Subagents are wired with the subagents-as-tools
pattern (isolated context windows, focused prompts, natural parallelism), built
on @developerz.ai/ai-claude-compat.
| What you type | What aitm does |
|---|---|
aitm start "add password reset flow" | Splits into schema + endpoint + email + tests, one PR per slice |
aitm start "rename Logger to Tracer everywhere" --max-prs 1 | Single sweeping PR, full test pass before merge |
aitm start "add tests for src/billing/* until 90% coverage" | Iterates until the coverage target hits, or the session cap |
aitm start "bump zod to v4 and fix all type errors" | Bumps, fixes, runs tests, opens PR; conflicts surface as blocked |
User config lives at ~/.aitm.json; per-project overrides at
.ai-task-master/config.json:
aitm config set models.smart anthropic/claude-opus-4.7
aitm config set models.coding anthropic/claude-sonnet-4.6
aitm config set models.fast openai/gpt-5-mini
aitm config set autoMerge true --project
aitm config list
Provider: any OpenAI-compatible endpoint via one credential — OpenRouter by
default, or set baseURL to run on z.ai GLM, a self-hosted gateway, etc. No
Anthropic SDK. Profiles switch the whole provider in one command:
aitm profile add z.ai --preset zai --api-key "<your z.ai key>"
aitm profile use z.ai # ✅ verified end-to-end on z.ai GLM (glm-5.2 / glm-5-turbo)
aitm profile use openrouter
See providers
and aitm profile.
Coding style: aitm reads your repo's CLAUDE.md / AGENTS.md and feeds
it to subagents as a style signal (the provider stays OpenRouter).
MCP: aitm is an MCP client — declare mcpServers in config and their
tools mount into the subagent tool surfaces.
OPENROUTER_API_KEY in the environment.gh CLI, authenticated (PRs, CI status, reviews).MIT · source & full docs
FAQs
Autonomous task orchestrator. Goal in, merged PRs out.
The npm package @developerz.ai/aitm receives a total of 43 weekly downloads. As such, @developerz.ai/aitm popularity was classified as not popular.
We found that @developerz.ai/aitm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.