
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
@tekdi/coding-analytics
Advanced tools
Monitor Cursor & Claude Code usage and send analytics to PostHog. Uses hooks to capture events.
Monitor Cursor and Claude Code usage in real-time and send analytics to PostHog for team-wide insights and pattern detection.
Hooks into Cursor and Claude Code on each developer's machine to capture:
Events are written to a local queue and flushed to PostHog every 5 minutes by a cron job, so hooks never block your editor.
Mac/Linux:
curl -fsSL https://raw.githubusercontent.com/tekdi/coding-analytics/main/install-scripts/install.sh | bash
Windows (PowerShell as Administrator):
Invoke-WebRequest -Uri https://raw.githubusercontent.com/tekdi/coding-analytics/main/install-scripts/install.ps1 -OutFile install.ps1
.\install.ps1
Manual installation:
npm install -g @tekdi/coding-analytics
# Configure PostHog
coding-analytics config --posthog-key="phc_your_key_here"
coding-analytics config --posthog-host="https://eu.i.posthog.com"
# Install hooks for both providers (also sets up the flush cron)
coding-analytics install-hooks
coding-analytics status
Expected output:
=== Coding Analytics Status ===
Overall: ✓ healthy
Hooks & Infrastructure:
Cursor Hooks: ✓ Installed
Claude Hooks: ✓ Installed
Flush Cron: ✓ Installed (every 5 min)
Queue: 0 event(s) pending
Backend:
PostHog: ✓ Connected
Local Storage: ✓ OK
Last Event: 2026-03-26T10:30:00Z
Auth IDs:
Claude: 44c72054-****-****-****-a9743dc0d9bb
Cursor: a*****@yourorg.com
| PostHog Event | Trigger |
|---|---|
cursor_chat_started | New chat opened |
cursor_message_sent | User sends a message |
cursor_message_received | AI responds |
cursor_code_edited | Files changed via AI |
cursor_chat_ended | Chat session closed |
cursor_agent_thinking | Agent reasoning (if available) |
| PostHog Event | Trigger |
|---|---|
claude_session_started | Claude Code session begins |
claude_prompt_submitted | User submits a prompt |
claude_tool_used | Any tool call completes (Bash, Edit, Read, etc.) |
claude_subagent_started | Subagent spawned |
claude_subagent_stopped | Subagent completes |
claude_session_stopped | Session ends |
cursor or claude tag on every eventLocation: ~/.coding-analytics/config.json
coding-analytics config --edit # open in $EDITOR
coding-analytics config --show # print current config
{
"posthog": {
"apiKey": "phc_your_key",
"host": "https://eu.i.posthog.com",
"batchSize": 100,
"flushInterval": 5000
},
"capture": {
"prompts": true,
"responses": false,
"fileContent": false,
"filePaths": true,
"agentThinking": true
},
"privacy": {
"hashUserIds": true,
"redactSecrets": true,
"allowedRepos": [
"github.com/tekdi/*"
]
},
"storage": {
"fallbackToLocal": true,
"localDbPath": "~/.coding-analytics/events.json",
"retryFailedEvents": true,
"maxRetries": 3
}
}
Automatically strips from prompt content before queuing:
Restrict capture to specific repositories:
{
"privacy": {
"allowedRepos": ["github.com/tekdi/*", "github.com/myorg/public-*"]
}
}
coding-analytics config --posthog-key="phc_..."
coding-analytics config --posthog-host="https://eu.i.posthog.com"
coding-analytics config --edit
coding-analytics config --show
# Install hooks for both Cursor and Claude Code + flush cron
coding-analytics install-hooks
# Install for a specific provider only
coding-analytics install-hooks --provider cursor
coding-analytics install-hooks --provider claude
# Uninstall
coding-analytics uninstall-hooks
coding-analytics uninstall-hooks --provider cursor
coding-analytics status # full health check
coding-analytics test # test PostHog connection
coding-analytics events --recent 20 # view sent events (fallback storage)
coding-analytics events --provider claude # filter by provider
coding-analytics events --provider cursor
coding-analytics logs --tail # follow log file
coding-analytics logs --lines 100
coding-analytics flush # manually flush queue to PostHog (normally run by cron)
coding-analytics retry # retry events that failed to send (from fallback storage)
Events are processed in two stages to avoid any latency impact on your editor:
Hook fires (every tool call / prompt / etc.)
└─ coding-analytics hook / claude-hook
→ map event type (~1ms)
→ apply privacy filters (~1ms)
→ append to queue.jsonl (~2ms)
→ exit total: ~5ms
Every 5 minutes (cron)
└─ coding-analytics flush
→ drain queue.jsonl atomically
→ enrich batch with git + system context
(git cached per workspace — 1 call per repo, not per event)
→ send to PostHog
→ on failure: store in events.json for retry
The cron is installed automatically by install-hooks. To verify:
crontab -l | grep coding-analytics
Tool usage breakdown (Claude Code):
SELECT
properties.tool_name,
COUNT(*) as uses,
countIf(properties.exit_code != 0) as errors
FROM events
WHERE event = 'claude_tool_used'
AND timestamp > now() - interval '7 days'
GROUP BY tool_name
ORDER BY uses DESC
Most active users across both providers:
SELECT
distinct_id,
properties.provider,
COUNT(*) as event_count
FROM events
WHERE timestamp > now() - interval '7 days'
GROUP BY distinct_id, provider
ORDER BY event_count DESC
High token sessions (Cursor):
SELECT
properties.chat_id,
distinct_id,
SUM(properties.token_count) as total_tokens,
COUNT(*) as message_count
FROM events
WHERE event = 'cursor_message_sent'
AND timestamp > now() - interval '7 days'
GROUP BY chat_id, distinct_id
HAVING total_tokens > 5000
ORDER BY total_tokens DESC
Cursor: verify ~/.cursor/hooks.json exists and restart Cursor.
Claude Code: verify ~/.claude/settings.json has hook entries and restart Claude Code.
coding-analytics status # shows which hooks are installed
coding-analytics logs --tail # watch for errors in real time
coding-analytics test # check PostHog connectivity
coding-analytics flush # manually trigger a flush
coding-analytics events # check fallback storage for unsent events
coding-analytics retry # resend events that previously failed
Check the PostHog host — use your project's ingestion URL:
coding-analytics config --posthog-host="https://eu.i.posthog.com" # EU cloud
coding-analytics config --posthog-host="https://us.i.posthog.com" # US cloud
crontab -l # verify cron entry exists
coding-analytics install-hooks # reinstalls cron if missing
cat ~/.coding-analytics/logs/flush.log # check flush run history
coding-analytics status shows (not found) for an auth ID:
~/.claude.json)~/.cursor/ or ~/Library/Application Support/Cursor/)git clone https://github.com/tekdi/coding-analytics.git
cd coding-analytics/src
npm install
npm run build
npm link
coding-analytics --version
coding-analytics/
├── src/
│ ├── cli.ts # CLI entry point & all commands
│ ├── queue.ts # Append-only JSONL event queue
│ ├── flusher.ts # Batch enrichment & PostHog send
│ ├── hooks-listener.ts # Cursor hook event mapper
│ ├── claude-hooks-receiver.ts # Claude Code hook event mapper
│ ├── enricher.ts # Git, system & user ID enrichment
│ ├── batcher.ts # PostHog batch sender
│ ├── local-storage.ts # JSON fallback for failed sends
│ ├── install-service.ts # Hook + cron installation
│ ├── health-monitor.ts # Status checks & auth ID display
│ ├── config.ts # Configuration management
│ └── logger.ts # Winston logger
├── install-scripts/
│ ├── install.sh # Mac/Linux installer
│ └── install # Windows PowerShell installer
└── package.json
MIT — see LICENSE file
Author: Tekdi Technologies
Package: @tekdi/coding-analytics
Version: 1.0.0
FAQs
Monitor Cursor & Claude Code usage and send analytics to PostHog. Uses hooks to capture events.
We found that @tekdi/coding-analytics demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.