
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@rhobot-dev/pi-ralph
Advanced tools
pi extension/package for managing ralph loops from inside the pi TUI.
/ralph overlay to inspect loops, follow logs, and run common loop actionsralph_loop(...) LLM tool to start loops in a PTY (so the native ralph TUI can be embedded)pi (works with the current pi package system)ralph on your PATH (tested with ralph 2.4.4)pi install npm:@robot-dev/pi-ralph
pi install ~/projects/pi-ralph
pi in a project where ralph works (has a ralph.yml)./ralphOverlay:
Esc close (or back out of confirm/subviews)←/→ switch focused loopShift+Up/Down scroll (PTY)s stop (confirm with y/n)m merged discard (confirm with y/n)r retryH history view (q back, arrows or j/k scroll)D diff view (q back)a attach a shell in the loop's directory/worktreeMain editor:
Ctrl+Shift+R cycle focused loopThe extension registers a tool:
ralph_loop(prompt, directory, config?, maxIterations?, backend?, customArgs?)This spawns ralph run in a PTY so the native ralph TUI can be embedded in the overlay.
ralph loops list --json may label the in-place loop as (primary). For commands that require an actual loop ID (history/diff/logs/retry), pi-ralph attempts to resolve it from .ralph/current-loop-id.ralph is not found on PATH, the extension disables itself gracefully.This repo publishes to npm via GitHub Actions.
package.json version.v* tag:git tag v0.1.0
git push origin v0.1.0
The workflow supports npm Trusted Publishing (OIDC). Configure it in npm package settings (Trusted Publisher: GitHub Actions). If you haven't set that up yet, the workflow falls back to NPM_TOKEN.
FAQs
pi extension/package to manage ralph loops from within the pi TUI
The npm package @rhobot-dev/pi-ralph receives a total of 5 weekly downloads. As such, @rhobot-dev/pi-ralph popularity was classified as not popular.
We found that @rhobot-dev/pi-ralph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.