
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@mind-fold/trellis
Advanced tools
AI capabilities grow like ivy — Trellis provides the structure to guide them along a disciplined path
English | 中文
AI capabilities grow like ivy — full of vitality but climbing in all directions. Trellis provides the structure to guide them along a disciplined path.
Based on Anthropic's Effective Harnesses for Long-Running Agents, with engineering practices and improvements for real-world usage.
pnpm install -g @mind-fold/trellis
# or
npm install -g @mind-fold/trellis
# Initialize in your project
trellis init
# or use short alias
tl init
# Initialize with developer name
trellis init -u your-name
# Initialize for specific tools only
trellis init --cursor # Cursor only
trellis init --claude # Claude Code only
trellis init --cursor --claude # Both (default)
Trellis creates a structured workflow system in your project:
your-project/
├── workflow/
│ ├── .developer # Developer identity (gitignored)
│ ├── flow.md # Workflow guide
│ ├── agent-traces/ # Session tracking
│ │ └── {developer}/ # Per-developer progress
│ │ ├── index.md # Progress index
│ │ ├── features/ # Feature tracking
│ │ │ ├── {day}-{name}/ # Feature directory
│ │ │ │ └── feature.json
│ │ │ └── archive/ # Completed features
│ │ └── progress-N.md # Session records
│ ├── structure/ # Development guidelines
│ │ ├── frontend/ # Frontend standards
│ │ ├── backend/ # Backend standards
│ │ └── flows/ # Thinking guides
│ └── scripts/ # Utility scripts
│ ├── common/ # Shared utilities
│ │ ├── paths.sh # Path utilities
│ │ ├── developer.sh # Developer management
│ │ └── git-context.sh # Git context
│ ├── feature.sh # Feature management
│ ├── add-session.sh # Record sessions
│ ├── get-context.sh # Get session context
│ ├── get-developer.sh # Get developer name
│ └── init-developer.sh # Initialize developer
├── .cursor/commands/ # Cursor slash commands
├── .claude/commands/ # Claude Code slash commands
├── init-agent.md # AI onboarding guide
└── AGENTS.md # Agent instructions
Each developer (human or AI) gets their own progress tracking:
./workflow/scripts/init-developer.sh <name>
Pre-built commands for AI assistants:
| Command | Purpose |
|---|---|
/init-agent | Initialize AI session with context |
/before-frontend-dev | Read frontend guidelines before coding |
/before-backend-dev | Read backend guidelines before coding |
/check-frontend | Validate frontend code against guidelines |
/check-backend | Validate backend code against guidelines |
/check-cross-layer | Verify cross-layer consistency |
/finish-work | Pre-commit checklist |
/record-agent-flow | Record session progress |
/break-loop | Deep bug analysis |
/onboard-developer | Full workflow onboarding |
Structured guides to prevent common mistakes:
Track features with directory-based structure:
./workflow/scripts/feature.sh create my-feature # Create feature
./workflow/scripts/feature.sh list # List active features
./workflow/scripts/feature.sh archive my-feature # Archive completed
trellis init # Initialize workflow
trellis init -u <name> # Initialize with developer name
trellis init -y # Skip prompts, use defaults
trellis init -f # Force overwrite existing files
trellis init -s # Skip existing files
init-agent.md at session startworkflow/structure/workflow/agent-traces/This creates a structured, documented workflow where:
Trellis is built upon ideas and inspirations from:
FSL-1.1-MIT (Functional Source License, MIT future license)
Copyright © Mindfold LLC
FAQs
AI capabilities grow like ivy — Trellis provides the structure to guide them along a disciplined path
The npm package @mind-fold/trellis receives a total of 1 weekly downloads. As such, @mind-fold/trellis popularity was classified as not popular.
We found that @mind-fold/trellis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.