
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@pyrex/scud
Advanced tools
Fast, simple task master for AI-driven development - BMAD-TM workflow automation
Fast, simple task master for AI-driven development - Rust implementation.
This is a high-performance Rust rewrite of the SCUD task management system. It replaces the external task-master CLI with a fast, single-binary solution that:
scud (Rust Binary)
├── Core Commands (No AI - Instant)
│ ├── init # Initialize .taskmaster/
│ ├── tags # List epic tags
│ ├── use-tag # Switch active epic
│ ├── list # List tasks with filters
│ ├── show # Show task details
│ ├── set-status # Update task status
│ ├── next # Find next available task
│ └── stats # Show epic statistics
│
├── AI Commands (Direct Anthropic API)
│ ├── parse-prd # Parse PRD markdown into tasks
│ ├── analyze-complexity # Analyze task complexity
│ ├── expand # Break down complex tasks
│ └── research # AI-powered research
│
└── Storage (JSON)
├── .taskmaster/tasks/tasks.json
└── .taskmaster/workflow-state.json
cargo build
cargo build --release
# Initialize SCUD
scud init
# List epic tags
scud tags
# Switch to an epic
scud use-tag epic-1-auth
# List tasks
scud list
scud list --status pending
# Show task details
scud show 3
# Update task status
scud set-status 3 in-progress
# Find next available task
scud next
# Show statistics
scud stats
Requires: API key environment variable (see Provider Configuration)
# Parse PRD into tasks
scud parse-prd docs/epics/auth.md --tag epic-1-auth
# Analyze complexity
scud analyze-complexity # All tasks
scud analyze-complexity --task 5 # Specific task
# Expand complex tasks
scud expand 7 # Specific task
scud expand --all # All tasks >13 complexity
# Research a topic
scud research "OAuth 2.0 best practices"
| Operation | Old (task-master) | New (Rust) | Improvement |
|---|---|---|---|
| Startup | ~500ms | ~10ms | 50x faster |
| List tasks | ~100ms | ~5ms | 20x faster |
| Parse PRD | ~3-5s | ~2-3s | ~40% faster |
| Token overhead | ~21k | ~500 | 42x reduction |
SCUD supports multiple LLM providers: xAI (Grok), Anthropic (Claude), OpenAI (GPT), and OpenRouter.
# Initialize with xAI (Grok) - recommended for fast code generation
scud init --provider xai
export XAI_API_KEY=your-key
# Or initialize with Anthropic (Claude)
scud init --provider anthropic
export ANTHROPIC_API_KEY=your-key
# Interactive mode - prompt for provider
scud init
The configuration is stored in .taskmaster/config.toml:
[llm]
provider = "xai"
model = "grok-code-fast-1"
max_tokens = 4096
For complete provider documentation, see PROVIDERS.md.
| Provider | Environment Variable | Default Model |
|---|---|---|
| xAI | XAI_API_KEY | grok-code-fast-1 |
| Anthropic | ANTHROPIC_API_KEY | claude-sonnet-4-20250514 |
| OpenAI | OPENAI_API_KEY | gpt-4-turbo |
| OpenRouter | OPENROUTER_API_KEY | anthropic/claude-sonnet-4 |
struct Task {
id: String,
title: String,
description: String,
status: TaskStatus, // pending, in-progress, done, etc.
complexity: u32, // Fibonacci scale: 1,2,3,5,8,13,21
priority: Priority, // high, medium, low
dependencies: Vec<String>, // Task IDs this depends on
details: Option<String>, // Technical details
test_strategy: Option<String>,
complexity_analysis: Option<String>,
created_at: Option<String>,
updated_at: Option<String>,
}
struct Epic {
name: String,
tasks: Vec<Task>,
}
struct WorkflowState {
version: String,
current_phase: String, // ideation, planning, etc.
active_epic: Option<String>,
phases: HashMap<String, PhaseInfo>,
history: Vec<Value>,
completed_epics: Vec<CompletedEpic>,
last_updated: Option<String>,
}
Located in src/llm/prompts.rs:
parse_prd() - Converts markdown to structured tasksanalyze_complexity() - Scores task difficultyexpand_task() - Breaks down complex tasksresearch_topic() - AI research assistantThe Rust CLI integrates seamlessly with the existing SCUD system:
bin/scud.js detects and delegates to Rust binaryscud-cli/
├── Cargo.toml
├── src/
│ ├── main.rs # CLI entry point
│ ├── commands/
│ │ ├── mod.rs
│ │ ├── init.rs # Core commands
│ │ ├── tags.rs
│ │ ├── ...
│ │ └── ai/ # AI commands
│ │ ├── parse_prd.rs
│ │ ├── analyze_complexity.rs
│ │ ├── expand.rs
│ │ └── research.rs
│ ├── models/
│ │ ├── task.rs
│ │ ├── epic.rs
│ │ └── workflow.rs
│ ├── storage/
│ │ └── mod.rs # JSON I/O
│ └── llm/
│ ├── client.rs # Anthropic API
│ └── prompts.rs # Prompt templates
Commands enum in main.rssrc/commands/rustCommands array in bin/scud.jssrc/llm/prompts.rssrc/commands/ai/LLMClient::complete() or complete_json()# Build and test
cargo build
cargo test
# Test specific command
cargo run -- init
cargo run -- tags
cargo run -- --help
# Test AI commands (requires API key)
export ANTHROPIC_API_KEY=sk-...
cargo run -- parse-prd test.md --tag test
cargo build --release
# Binary: target/release/scud
# Copy to /usr/local/bin or similar
The SCUD npm package includes the Rust binary:
bin/scud.jsMIT
See main SCUD repository for contribution guidelines.
FAQs
Fast, simple task master for AI-driven development - BMAD-TM workflow automation
We found that @pyrex/scud demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.