
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@fullstacktard/claude-flow
Advanced tools
Automated template synchronization system for Claude Code configurations across multiple projects
Automated Claude Code configuration setup for existing projects with comprehensive task management, git worktree workflows, and testing infrastructure.
package.jsongit init)git remote add origin <url>)npx @fullstacktard/claude-flow init
# Navigate to your existing project
cd your-project
# Run the init command
npx @fullstacktard/claude-flow init
The CLI will:
Prompt for workflow preferences:
Create complete project structure:
src/, tests/, docs/, data/, scripts/ directoriestasks/, completed/, drafts/, templates/Install Claude Code configuration:
.claude/settings.json with permissions.claude/worktree-setup.md with git worktree workflows.claude/backlog-reference.md with task management guide.claude/testing-setup.md with testing standardsnotify.sh, enhanced-notify.sh)Set up development files:
CLAUDE.md - Base AI instructions (auto-managed, don't edit!)CLAUDE_PROJECT.md - Your project-specific customizationsvitest.config.js - Testing configuration.gitignore - Sensible defaults (only if missing).env - Environment template (only if missing)main.js - Entry point templateConfigure package.json:
"type": "module" for ESM supportInstall git hooks:
Install backlog CLI:
backlog.md CLI globally┌─────────────────────────────────────────────────────────────┐
│ 1. Run init │
│ npx @fullstacktard/claude-flow init │
└────────────────────┬────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Customize CLAUDE_PROJECT.md │
│ Add your API endpoints, DB schema, deployment info │
└────────────────────┬────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Tell Claude what to build │
│ Claude reads your context and creates structured tasks │
└────────────────────┬────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Claude works on tasks │
│ Creates worktrees, implements features, runs tests │
└────────────────────┬────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 5. Review and merge │
│ Claude creates PRs, you review, merge to main │
└─────────────────────────────────────────────────────────────┘
Project A (crypto-trading-bot)
│
├─ npx @fullstacktard/claude-flow init
├─ Edit CLAUDE_PROJECT.md (add trading API details)
└─ Claude builds features
Project B (nft-marketplace)
│
├─ npx @fullstacktard/claude-flow init
├─ Edit CLAUDE_PROJECT.md (add blockchain config)
└─ Claude builds features
Same Claude behavior, different project context!
Scenario: Building 3 different Solana DeFi projects simultaneously.
Before this package:
After this package:
# Project 1: Token swap
cd token-swap && npx @fullstacktard/claude-flow init
# Edit CLAUDE_PROJECT.md with Solana program details
# Project 2: NFT staking
cd nft-staking && npx @fullstacktard/claude-flow init
# Edit CLAUDE_PROJECT.md with staking logic
# Project 3: DAO governance
cd dao-governance && npx @fullstacktard/claude-flow init
# Edit CLAUDE_PROJECT.md with governance rules
Result: Same consistent Claude behavior across all 3 projects. Context stays lean. Task isolation via worktrees means no conflicts.
Scenario: 2-person team building a fullstack app. Want Claude to help both developers consistently.
Setup:
# Team lead runs once
npx @fullstacktard/claude-flow init
# Answer prompts:
# Git sync? Yes
# Pull requests? Yes
# Edit CLAUDE_PROJECT.md with:
# - API endpoints
# - Database schema
# - Testing requirements
# - Code review process
# Commit everything to git
git add .
git commit -m "Add Claude configuration"
git push
Other team member:
# Clone and get instant Claude setup
git clone <repo>
cd <repo>
# Claude immediately understands:
# - Project structure
# - Task workflow
# - Testing standards
# - PR requirements
Result: Both developers get identical Claude behavior. No setup discussions needed.
Scenario: Need to validate 5 different startup ideas quickly.
Traditional approach: Spend 2 hours per project configuring Claude, writing docs, setting up workflows.
With this package:
# Idea 1: 5 minutes to full Claude setup
mkdir idea-1 && cd idea-1
npm init -y && git init && git remote add origin <url>
npx @fullstacktard/claude-flow init
# Tell Claude what to build
# Idea 2: 5 minutes to full Claude setup
mkdir idea-2 && cd idea-2
npm init -y && git init && git remote add origin <url>
npx @fullstacktard/claude-flow init
# Tell Claude what to build
# ... repeat for ideas 3-5
Result: Go from idea to working prototype in hours, not days. Spend time building, not configuring.
For solo developers:
For teams:
For rapid prototyping:
For agencies/consultants:
your-project/
├── CLAUDE.md # Base AI instructions (auto-managed, DON'T EDIT)
├── CLAUDE_PROJECT.md # Your custom rules (EDIT THIS)
├── .env # Environment variables (created if missing)
├── .gitignore # Git exclusions (created if missing)
├── main.js # Entry point
├── package.json # Updated with test scripts
├── vitest.config.js # Test configuration
├── .claude/
│ ├── settings.json # Claude permissions & hooks
│ ├── worktree-setup.md # Git worktree workflows
│ ├── backlog-reference.md # Task management guide
│ ├── testing-setup.md # Testing standards
│ ├── notify.sh # Basic notifications
│ └── enhanced-notify.sh # Enhanced notifications
├── backlog/
│ ├── tasks/ # Active tasks
│ ├── completed/ # Archived tasks
│ ├── drafts/ # Draft tasks
│ ├── templates/
│ │ └── task-template.md # Task structure template
│ └── config.yml # Backlog configuration
├── scripts/
│ ├── validate-task.js # Task validation
│ └── update-project-structure.js # Project file sync
├── src/ # Source code
├── tests/ # Test files
├── docs/ # Documentation
└── data/ # Data files (git-ignored)
When you run init, you'll be asked:
"Sync with main before starting each task?"
"Use pull requests instead of direct merges?"
Your choices modify the generated templates:
If git sync is disabled:
CLAUDE.md - Removes "MANDATORY GIT SYNC" sectionworktree-setup.md - Removes sync instructionsbacklog-reference.md - Removes sync stepsIf PRs are disabled:
CLAUDE.md - Changes to "Direct merges allowed"task-template.md - Updates acceptance criteriagh pr createNEVER edit CLAUDE.md directly! It's auto-managed from the npm package.
Instead, edit CLAUDE_PROJECT.md to add:
Example:
# Project-Specific Configuration
## API Endpoints
- Production: https://api.myproject.com
- Staging: https://staging.myproject.com
## Database
- Schema: PostgreSQL 15
- Migration tool: `npm run migrate`
- Seed data: `npm run seed`
## Deployment
- Production: `npm run deploy:prod`
- Requires: AWS_ACCESS_KEY, AWS_SECRET_KEY
## Restrictions
- Never modify `/legacy` directory
- Always use custom logger at `src/utils/logger.js`
- All API calls must go through `src/api/client.js`
The package creates a .gitignore file (if missing) with:
node_modules/
.env
.env.local
.env.*.local
data/
Note: CLAUDE.md and .claude/ are tracked in git so team members get the configuration.
The setup includes a complete backlog.md integration that structures how Claude works with tasks:
What Claude gets:
.claude/backlog-reference.md - Complete guide on task workflowsbacklog/templates/task-template.md - Standardized task formatscripts/validate-task.js - Automated task validationHow Claude uses it:
Task structure includes:
Claude doesn't need manual instructions - the task template guides the entire workflow.
The system provides Claude with comprehensive worktree workflows:
What Claude gets:
.claude/worktree-setup.md - Complete worktree guide with examplesBenefits:
How it's organized:
your-project/ # Main repository
../your-project-worktrees/
├── task-42/ # Worktree for task 42
├── task-43/ # Worktree for task 43
└── task-44/ # Worktree for task 44
Claude understands:
No manual explanation needed - Claude reads the workflow guide and follows it.
The package includes vitest.config.js with:
**/*.test.js, **/*.spec.js){
"scripts": {
"test": "vitest",
"test:run": "vitest run"
}
}
import { describe, it, expect } from 'vitest';
describe('User Authentication', () => {
it('should validate credentials', () => {
expect(validateUser('user', 'pass')).toBe(true);
});
});
See .claude/testing-setup.md for standards.
When running init:
GitHub CLI (for PR workflows):
# macOS
brew install gh
# Authenticate
gh auth login
# Ensure package.json exists
npm init -y
# Then run init
claude-flow init
# Initialize git
git init
# Then run init
claude-flow init
# Add remote
git remote add origin https://github.com/user/repo.git
# Or create with GitHub CLI
gh repo create
# Then run init
claude-flow init
# Manually validate task
node scripts/validate-task.js backlog/tasks/task-42-*.md
# Install globally with appropriate permissions
sudo npm install -g @fullstacktard/claude-flow
# Update to latest version
npm update -g @fullstacktard/claude-flow
# Or with npx (always uses latest)
npx @fullstacktard/claude-flow@latest init
When you reinstall or update:
Your customizations are safe:
CLAUDE_PROJECT.md is never touched.gitignore is only created if missing.env is only created if missingMIT © fullstacktard
FAQs
Automated template synchronization system for Claude Code configurations across multiple projects
We found that @fullstacktard/claude-flow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.