
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
@sylphx/cue
Advanced tools
Cue — video answers with timestamp-level proof. Local-first timelines, subtitles, scenes, and frame evidence.
Cue gives agents a local video timeline they can search and cite: streams, chapters, subtitles, scenes, frames, and exact timestamps.
npx -y @sylphx/cue
For Claude Code:
claude mcp add cue -- npx -y @sylphx/cue
{
"sources": [{ "path": "/absolute/path/to/demo.mp4" }],
"include_subtitles": true
}
Then ask:
“Find the moment where the presenter explains the pricing change.”
Cue returns the matching timestamp, surrounding transcript, source hash, and a route to render or crop the exact frame.
| Ask your agent | Cue returns |
|---|---|
| “Find this quote.” | timestamped transcript evidence |
| “Summarize this meeting.” | chapters and subtitle-backed notes |
| “Where is the code shown?” | timestamped frame and crop evidence |
| “What changed in this demo?” | timeline and structural scene boundaries |
| “Give me the useful moments.” | compact timeline with warnings and gaps |
| Tool | Purpose |
|---|---|
read_video | Build a local timeline from streams, subtitles, scenes, and keyframes |
search_video | Search subtitles/transcripts and return timestamped matches |
video_evidence | Render, crop, or OCR a frame at a known timestamp |
fast probes streams and reads embedded metadata/subtitles.quality explicitly requests scene detection, keyframes, OCR, or local ASR.Every claim can point back to timestamp_ms, stream index, subtitle range,
frame index, or source hash. Structural keyframes are preferred over sampling
every frame.
| Product | Job |
|---|---|
| Citra | PDF answers with page-level proof |
| Iris | Image facts and pixel evidence |
| Spine | Repository architecture and impact |
| Locus | Exact code-chunk retrieval |
| Lookout | Web research with source excerpts |
Each product is independent. Install only the tools your agent needs.
bun install
bun run build
bun test
cargo test
bun run benchmark:public-proof
bun run benchmark:release-gate
MIT
FAQs
Cue — video answers with timestamp-level proof. The default read returns container metadata, streams, chapters, and embedded subtitles. Scenes and frames are separate.
The npm package @sylphx/cue receives a total of 1,214 weekly downloads. As such, @sylphx/cue popularity was classified as popular.
We found that @sylphx/cue demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.