
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@letta-ai/letta-code
Advanced tools
Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.
Letta Code is a memory-first coding harness, built on top of the Letta API. Instead of working in independent sessions, you work with a persisted agent that learns over time and is portable across models (Claude Sonnet/Opus, GPT/Codex, Gemini, GLM, Kimi, and more).
Read more about how to use Letta Code on the official docs page.

Install the package via npm:
npm install -g @letta-ai/letta-code
Navigate to your project directory and run letta (see various command-line options on the docs).
Run /connect to configure your own LLM API keys (OpenAI, Anthropic, etc.), and use /model to swap models.
[!NOTE] By default, Letta Code will to connect to the Letta API. Use
/connectto use your own LLM API keys and coding plans (Codex, zAI, Minimax) for free. SetLETTA_BASE_URLto connect to an external Docker server.
Letta Code is built around long-lived agents that persist across sessions and improve with use. Rather than working in independent sessions, each session is tied to a persisted agent that learns.
Claude Code / Codex / Gemini CLI (Session-Based)
AGENTS.mdLetta Code (Agent-Based)
/clear starts a new conversation (aka "thread" or "session"), but memory persistsIf you’re using Letta Code for the first time, you will likely want to run the /init command to initialize the agent’s memory system:
> /init
Over time, the agent will update its memory as it learns. To actively guide your agents memory, you can use the /remember command:
> /remember [optional instructions on what to remember]
Letta Code works with skills (reusable modules that teach your agent new capabilities in a .skills directory), but additionally supports skill learning. You can ask your agent to learn a skill from its current trajectory with the command:
> /skill [optional instructions on what skill to learn]
Read the docs to learn more about skills and skill learning.
Community maintained packages are available for Arch Linux users on the AUR:
yay -S letta-code # release
yay -S letta-code-git # nightly
Made with 💜 in San Francisco
FAQs
Letta Code is a CLI tool for interacting with stateful Letta agents from the terminal.
We found that @letta-ai/letta-code demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.