
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@mind-fold/open-flow
Advanced tools
AI-assisted development workflow initializer for Cursor, Claude Code and more
AI-assisted development workflow initializer for Cursor, Claude Code and more.
Based on Anthropic's Effective Harnesses for Long-Running Agents.
AI coding assistants are powerful but lack continuity across sessions. open-flow adds a lightweight workflow system that gives AI "long-term memory" through structured documentation.
Key outcomes:
index.md + doc.md two-layer structure for efficient knowledge accessnpm install -g open-flow
cd my-project
open-flow init
You'll be prompted to select AI tools to configure:
your-project/
├── .cursor/commands/ # Cursor short commands
│ ├── init-agent.md
│ ├── check-frontend.md
│ ├── check-backend.md
│ ├── record-agent-flow.md
│ └── onboard-developer.md
├── .claude/commands/ # Claude Code short commands
├── workflow/
│ ├── scripts/
│ │ ├── init-developer.sh
│ │ └── get-developer.sh
│ ├── agent-progress/
│ │ └── index.md
│ ├── structure/
│ │ ├── frontend/
│ │ │ ├── index.md
│ │ │ └── doc.md
│ │ └── backend/
│ │ ├── index.md
│ │ └── doc.md
│ ├── feature.json
│ └── flow.md
├── init-agent.md
└── AGENTS.md
| Command | Purpose |
|---|---|
/init-agent | Initialize AI session, read context and guidelines |
/before-frontend-dev | Read frontend guidelines before starting development |
/before-backend-dev | Read backend guidelines before starting development |
/check-frontend | Check frontend code against guidelines |
/check-backend | Check backend code against guidelines |
/record-agent-flow | Record work progress (after human commits) |
/record-question | Document a solved problem for future reference |
/onboard-developer | Guide new developer through setup |
/update-frontend-structure | Update frontend guidelines if new patterns found |
/update-backend-structure | Update backend guidelines if new patterns found |
/create-command | Create a new slash command in both .cursor/ and .claude/ directories |
./workflow/scripts/init-developer.sh <your-name>
Use /init-agent command in your AI tool.
workflow/structure//record-agent-flow to record progressFill in your project-specific guidelines in:
workflow/structure/frontend/doc.mdworkflow/structure/backend/doc.mdRequirements:
@@@section:kebab-case-id and @@@/section:kebab-case-idindex.md files with section IDs for quick navigationInstead of reading entire guideline documents (which can be 1000+ lines), AI:
index.md (navigation table with section IDs)sed -n '/@@@section:ID/,/@@@\/section:ID/p' doc.mdSection markers (@@@section:id) ensure references don't break when content is added or removed.
This saves tokens and improves focus.
workflow/agent-progress/
├── index.md # Main index
└── {developer}/ # Per-developer directory
├── index.md # Personal index
└── progress-N.md # Progress files (max 2000 lines each)
Each developer has independent progress files that don't conflict during collaboration.
AI should NOT execute git commit. The workflow is:
open-flow init # Initialize in current project
open-flow update # Update configuration (coming soon)
open-flow --version # Show version
open-flow --help # Show help
| Aspect | OpenSpec | open-flow |
|---|---|---|
| Focus | Spec-driven development | Memory-driven workflow |
| Main feature | Change proposals & specs | Progress tracking & guidelines |
| Collaboration | Single change flow | Multi-developer directories |
| Guidelines | N/A | index.md + doc.md system |
Both can be used together - OpenSpec for specs, open-flow for workflow.
# Install dependencies
npm install
# Build
npm run build
# Development
npm run dev
MIT
FAQs
AI-assisted development workflow initializer for Cursor, Claude Code and more
The npm package @mind-fold/open-flow receives a total of 1 weekly downloads. As such, @mind-fold/open-flow popularity was classified as not popular.
We found that @mind-fold/open-flow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.