
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@img2threejs/pixi2d
Advanced tools
Installer-only CLI for the private img2pixi2d native OMP skill plugin.
Installer-only CLI for img2pixi2d, the private native OMP skill plugin for editable PixiJS 2D reconstruction. This npm package includes only the installer, metadata, this README and its Apache-2.0 license. It does not include the private skill, Python tools, examples, artwork or credentials. The installer license does not license the private source or user artwork.
PATH.img2threejs/pixi2d repository. The public npm installer does not grant repository access.venv/pip; install prepares an isolated Pillow environment.PATH for removal: OMP's native uninstall uses Bun even when OMP itself is a compiled executable.Configure private Git access without embedding credentials:
gh auth login --hostname github.com --git-protocol https
gh auth setup-git --hostname github.com
npx --yes @img2threejs/pixi2d@latest install --dry-run
npx --yes @img2threejs/pixi2d@latest install --yes
npx --yes @img2threejs/pixi2d@latest doctor
npx --yes @img2threejs/pixi2d@latest update --yes
npx --yes @img2threejs/pixi2d@latest remove --yes
The first --yes authorizes npx downloading the public CLI. The final --yes authorizes installer mutations. Without the final flag, mutations fail before touching HOME. --dry-run is offline and does not run subprocesses or write HOME.
Install clones https://github.com/img2threejs/pixi2d.git into ~/.local/share/img2threejs/pixi2d, checks out ea55d1534ad215ddb8060732ae581dbe2a662cb8, installs pinned Python requirements in its .venv, then registers it using omp plugin link. Keep the checkout: OMP links it by symlink. Start a new OMP session in your existing host project and invoke /skill:img2pixi2d with a readable reference image.
Update uses the source pin of the CLI version you run; it does not pull an unreviewed default branch. Existing checkouts must have the expected Git origin and no tracked/untracked changes. A registration pointing elsewhere is never replaced. To reuse another authorized clone, pass its absolute --directory on every command:
npx --yes @img2threejs/pixi2d@latest install --yes --directory /absolute/path/to/pixi2d
npx --yes @img2threejs/pixi2d@latest doctor --directory /absolute/path/to/pixi2d
Remove delegates to omp plugin uninstall pixi2d. It unregisters only; the source checkout, .venv, and host artwork remain. Doctor checks this installer's Git pin, skill file, Pillow import, matching native OMP registration and native plugin diagnostics; it is not a visual reconstruction review.
This is not an img2 harness plugin: img2 add pixi2d is not supported. The executable is img2pixi2d; the npm package is @img2threejs/pixi2d. --version reports installer version 0.1.0, independently of source skill version 1.0.0.
Run npm test in cli/, inspect npm pack --dry-run, then tag cli-v0.1.0. The pinned reusable workflow publishes only cli/ via npm Trusted Publishing. Provenance is disabled because the GitHub source repository is private. Source root package.json remains private: true.
FAQs
Installer-only CLI for the private img2pixi2d native OMP skill plugin.
The npm package @img2threejs/pixi2d receives a total of 0 weekly downloads. As such, @img2threejs/pixi2d popularity was classified as not popular.
We found that @img2threejs/pixi2d demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.