
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@openagentsinc/pylon
Advanced tools
Bootstrap the standalone OpenAgents Pylon release asset and run first-run smoke checks.
@openagentsinc/pylonBootstrap the latest tagged standalone Pylon release asset from GitHub
Releases, fall back to a deterministic source build when no matching asset
exists for the local platform, stream first-run status updates in the terminal,
and open the Pylon terminal UI without Cargo when prebuilt binaries are
available.
npx @openagentsinc/pylon
bunx @openagentsinc/pylon
npm install -g @openagentsinc/pylon && pylon
bun install -g @openagentsinc/pylon && pylon
npx @openagentsinc/pylon --version 0.0.1-rc10
npx @openagentsinc/pylon --no-launch
npx @openagentsinc/pylon --download-curated-cache --model gemma-4-e2b --diagnostic-repeats 2
npx @openagentsinc/pylon --verbose
The launcher:
npx / bunx execution plus global npm install -g /
bun install -g installs with the same pylon commandpylon-v... release on each default run,
or resolves a specific tagged Pylon version when --version is providedpylon-v<version>-<os>-<arch>.tar.gz asset for the
current machinepylon plus
pylon-tui locally when no matching release asset exists for the machinerustup if a source build
is needed and cargo / rustc are missingopenagents.com so the
public stats page can show install starts, completions, source-build fallbacks,
Rust prompts, and smoke-test outcomes~/.openagents/pylon/bootstrap/pylon launcher remains the command on
PATHfully online, runtime ready, or installed but runtime missing, plus exact next-step guidancepylon --help, init, status --json, and inventory --jsonpylon gemma diagnose <model> --jsonpylon gemma download <model> when --download-curated-cache is
set, because the optional GGUF cache does not satisfy the sellable runtime by
itselfcurl for release metadata and asset downloads when the Node
fetch path fails in constrained network contextspylon-tui by default after the smoke path unless --no-launch is setSet OPENAGENTS_DISABLE_TELEMETRY=1 to disable installer telemetry, or
OPENAGENTS_TELEMETRY_URL=http://127.0.0.1:8000/api/telemetry/events to point
the launcher at a non-production telemetry endpoint.
Publish directly from this package directory:
cd packages/pylon-bootstrap
npm pack --dry-run
npm publish
FAQs
Bootstrap the standalone OpenAgents Pylon release asset and run first-run smoke checks.
We found that @openagentsinc/pylon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.