
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@forgespace/siza-gen
Advanced tools
Siza AI generation engine — multi-framework code generation, component registry, and ML-powered quality scoring
Siza AI generation engine — multi-framework code generation, component registry, and ML-powered quality scoring.
@forgespace/siza-gen is the AI brain extracted from
ui-mcp. It provides:
npm install @forgespace/siza-gen
/lite)A zero-native-dependency entry point for edge runtimes (Cloudflare Workers, Deno, Bun). Provides context assembly without the registry/database/ML stack.
import { assembleContext } from '@forgespace/siza-gen/lite';
const ctx = assembleContext({
framework: 'react',
componentLibrary: 'shadcn',
tokenBudget: 4000,
});
// ctx.systemPrompt — ready to use as LLM system prompt
43 KB vs 1.87 MB full bundle. Includes brandToDesignContext,
designContextStore, and all core types.
import {
searchComponents,
initializeRegistry,
GeneratorFactory,
} from '@forgespace/siza-gen';
await initializeRegistry();
const results = searchComponents('hero section');
const generator = GeneratorFactory.create('react');
| Module | Description |
|---|---|
generators/ | React, Vue, Angular, Svelte, HTML code generators |
registry/ | 540+ snippets — component, animation, backend, dashboard, settings |
ml/ | Embeddings (all-MiniLM-L6-v2), quality scoring, training pipeline |
feedback/ | Self-learning loop, pattern promotion, feedback-boosted search |
quality/ | Anti-generic rules, diversity tracking |
artifacts/ | Generated artifact storage and learning loop |
Built-in multi-provider support with auto-fallback:
import { createProviderWithFallback } from '@forgespace/siza-gen';
// Tries Ollama first (local), falls back to OpenAI/Anthropic/Gemini
const provider = await createProviderWithFallback();
Supports: Ollama (local), OpenAI, Anthropic, Gemini (via OpenAI adapter).
Transform branding-mcp tokens into design context:
import { brandToDesignContext } from '@forgespace/siza-gen';
const designContext = brandToDesignContext(brandIdentity);
An optional Python FastAPI sidecar handles compute-intensive ML operations. When unavailable, the system gracefully degrades to Transformers.js and heuristics.
cd python && pip install -e ".[dev]"
python -m uvicorn siza_ml.app:app --port 8100
Or via npm:
npm run sidecar:start # Launch Python sidecar
npm run sidecar:test # Run Python tests (41 tests)
| Endpoint | Description |
|---|---|
POST /embed | Sentence-transformer embeddings |
POST /embed/batch | Batch embeddings |
POST /vector/search | FAISS k-NN similarity search |
POST /score | LLM-based quality scoring |
POST /enhance | LLM-based prompt enhancement |
POST /train/start | LoRA fine-tuning via PEFT |
GET /health | Liveness check |
GET /metrics/report | ML observability metrics |
Fallback chain: Python sidecar → Transformers.js/local LLM → heuristics.
npm install && npm run build
npm test # 573 tests, 26 suites
npm run validate # lint + format + typecheck + test
npm run format # apply repo-wide Prettier formatting
npm run registry:stats # Report snippet counts
@forgespace/siza-gensonar-project.properties includes targeted CPD exclusions for
src/registry/component-registry/molecules/ai-patterns.ts and
src/registry/component-registry/molecules/data-display.ts. These files contain
intentional registry template repetition and are excluded from duplication
quality-gate calculations only.
Run the benchmark suite to compare LLM providers on generation quality, scoring accuracy, prompt enhancement effectiveness, and cost:
npm run bench:dry # Preview plan without API calls
npm run bench # Run full benchmark (requires API keys or Ollama)
Set provider API keys as environment variables:
export ANTHROPIC_API_KEY=sk-...
export OPENAI_API_KEY=sk-...
export GEMINI_API_KEY=...
Results are saved to benchmarks/report-{date}.json with a console summary.
This repository follows the shared Forge Space GitHub work-management baseline:
See
Forge-Space/.github GOVERNANCE.md
for the org-wide contract.
MIT
FAQs
Siza AI generation engine — multi-framework code generation, component registry, and ML-powered quality scoring
We found that @forgespace/siza-gen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.