
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@injectivelabs/ainj
Advanced tools
AInj is an AI SDK for Injective that packages 3 functions into 1 interface:
injectived)It is designed for agentic development setups where tools, docs, and project skills should all be available through a single installation.
This project is for engineers who want to:
AInj ships with these top-level commands:
ainj install wizard that configures local or global AInj stateainj status shows the current AInj configuration, installed skills, and configured portsainj skills lists installed skills available in the current projectainj cli ... runs the bundled injectived CLI
ainj injectived ...ainj cli version or ainj injectived versionainj mcp ... starts MCP servers over stdio or HTTP
ainj mcp docs http ... then connect to it using an MCP clientainj update updates the installed package to the latest published versionAt the library level, AInj exports:
cli for running injectivedmcp.main for the Injective tools MCP servermcp.docs for the Injective docs MCP serverskills for invoking installed skills through an AI harnessInstall AInj globally if you want the ainj command available everywhere (recommended):
npm install -g @injectivelabs/ainj
Install it locally if you do not need the ainj command, and mainly intend to interact with it programmatically.
npm install @injectivelabs/ainj
After installation, run the setup flow:
ainj install
Interactive setup lets you choose:
By default the wizard uses:
30013002ainj install WritesAInj stores its own state in:
${HOME}/.ainj/config.json./.ainj/config.jsonDepending on the harnesses you select, it also adds MCP server entries. These include both stdio and HTTP variants.
During interactive setup, AInj also will prompt you to install agent skills.
ainj status
This prints the installed version, scope, configured ports, selected harnesses, default harness, and installed skills.
ainj skills
If no skills are installed yet, AInj will tell you to run:
npm run sync:skills
ainj cli version
ainj injectived version
Both commands resolve the packaged injectived binary and pass through the remaining arguments.
Start just the main Injective tools server:
ainj mcp main stdio
ainj mcp main http
Start just the docs server:
ainj mcp docs stdio
ainj mcp docs http
Start both servers together:
ainj mcp stdio
ainj mcp http
The HTTP transports listen on:
http://localhost:3001/mcphttp://localhost:3002/mcpYou can override the ports with environment variables:
AINJ_MCP_MAIN_PORTAINJ_MCP_DOCS_PORTIf you would like to manually inspect/debug the MCP servers, use the official MCP inspector.
DANGEROUSLY_OMIT_AUTH=true npx -y @modelcontextprotocol/inspector
This will open up a web app, by default at: http://localhost:6274/.
The easiest is for the http MCP servers.
Ensure that you already have the server running, then select the following options:
Transport type: Streamable HTTP
URL: http://localhost:3001/mcp (for main MCP)
URL: http://localhost:3002/mcp (for docs MCP)
Connection Type: Via proxy
Authentication: (delete any entries)
For the stdio MCP servers, no need to run them first, the inspector run it for you.
Select the following options:
Transport type: STDIO
Command: ainj
Arguments: mcp main stdio (for main MCP)
Arguments: mcp docs stdio (for docs MCP)
Authentication: (delete any entries)
The CLI loads a .env file from the current working directory before executing commands.
Useful variables:
AINJ_MCP_MAIN_PORT=3001
AINJ_MCP_DOCS_PORT=3002
Existing shell environment variables take precedence over .env.
injectivedimport { cli } from '@injectivelabs/ainj';
const { stdout, stderr } = await cli('version');
console.log(stdout, stderr);
Start and manage a local stdio-backed MCP session:
import { mcp } from '@injectivelabs/ainj';
await mcp.main.start();
const tools = await mcp.main.toolCall('tools/list');
await mcp.main.stop();
Connect to an already-running HTTP MCP server:
import { mcp } from '@injectivelabs/ainj';
await mcp.docs.connect('http://localhost:3002/mcp');
const tools = await mcp.docs.toolCall('tools/list');
await mcp.docs.disconnect();
import { skills } from '@injectivelabs/ainj';
const result = await skills.run('my-skill', { topic: 'perps' });
console.log(result.stdout);
skills.run() uses the configured default harness from AInj state.
If no default harness is configured, it will ask you to run ainj install.
You can force a specific supported harness:
import { skills } from '@injectivelabs/ainj';
await skills.runWithClaude('my-skill');
await skills.runWithCodex('my-skill');
The two MCP services have different roles:
main exposes Injective tooling from github.com/InjectiveFoundation/injective-coredocs proxies the Injective documentation MCP endpoint, using content from docs.injective.networkThe HTTP mode wraps MCP sessions behind /mcp, while stdio mode is intended for direct tool-host integration.
Install dependencies:
npm install
Link (so that ainj is available on CLI equivalent to npm install --global):
npm link .
Run tests:
npm test
Run linting:
npm run lint
Refresh project skills:
npm run sync:skills
See TERMS_OF_USE.
FAQs
An AI SDK for Injective
The npm package @injectivelabs/ainj receives a total of 5 weekly downloads. As such, @injectivelabs/ainj popularity was classified as not popular.
We found that @injectivelabs/ainj demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 13 open source maintainers collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.