
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@getforma/kmd
Advanced tools
Kausing Much Damage to dev workflow chaos.
K.md is a local-first developer dashboard for navigating, searching, and annotating markdown documentation across your monorepo. It bundles a Rust server with a reactive TypeScript frontend into a single binary — no config, no cloud, just kmd.
.md files in your workspacenpx @getforma/kmd
Or install globally:
npm i -g @getforma/kmd
kmd
Run from any directory containing markdown files:
kmd
kmd starts a local server (default port 4444) and opens your browser. It recursively discovers all .md files from the current directory.
kmd # Start in current directory, open browser
kmd --port 3000 # Use a custom port
kmd --no-open # Start without opening browser
kmd --force # Force start even if port is in use
| Shortcut | Action |
|---|---|
Cmd/Ctrl + K | Focus search |
Cmd/Ctrl + Shift + H | Highlight selected text with last-used color |
Escape | Close toolbar / dismiss |
npm install
npm run dev
Builds the client and starts the Rust server with hot-reload.
npm run build
npm test
Runs the Playwright E2E test suite (34 tests covering app shell, markdown explorer, script runner, port monitor, security, and more).
npm run link
Symlinks the built binary to ~/.local/bin/kmd for global access.
client/ TypeScript frontend (@getforma/core reactive framework)
pages/ Page components (DocsPage, ScriptsPage, PortsPage, TerminalPage)
components/ Reusable components (FileTree, SearchBar)
styles/ Gruvbox dark/light theme CSS
lib/ Utilities (security, mermaid, logging)
src/ Rust backend (Axum web framework)
server.rs HTTP/WS routes, static file serving, CSRF protection
db.rs SQLite schema (annotations, bookmarks, FTS)
services/ Markdown rendering, port scanning, env parsing
tests/e2e/ Playwright end-to-end tests
npm/ Platform-specific binary packages for npm distribution
MIT
FAQs
K.md — kausing much damage to dev workflow chaos
The npm package @getforma/kmd receives a total of 0 weekly downloads. As such, @getforma/kmd popularity was classified as not popular.
We found that @getforma/kmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.