
Security News
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
@thinqmesh/hrkit
Advanced tools
Local, white-label, AI-augmented HR app. One Python package, one SQLite file, no SaaS. This npm wrapper bootstraps and runs HR-Kit so users who only know npm can `npx @thinqmesh/hrkit serve`.
npx wrapper for HR-Kit — a local, white-label, AI-augmented HR app in one Python package. This npm package shells out to
python -m hrkitso users who only know npm can install and run HR-Kit without touching pip directly.
A complete HR application that runs entirely on the HR person's laptop. Eleven modules (employees, departments, roles, documents, leave, attendance, payroll, performance, onboarding, exits, recruitment), one SQLite file, one Python process. AI assistant via your own OpenRouter or Upfyn key. Composio integrations for Gmail / Calendar / Drive. No SaaS, no per-seat fees, no vendor lock-in. MIT licensed.
The full repo, source, and Python README live at github.com/AnitChaudhry/HRKit.
# Run with npx (recommended — no global install)
npx @thinqmesh/hrkit serve
# Or install globally
npm install -g @thinqmesh/hrkit
hrkit serve
That's it. The wrapper will:
hrkit Python package is installed.pip install hrkit from PyPI (override the source with
HRKIT_INSTALL_SOURCE=git if you want the GitHub main branch instead).python -m hrkit <args>.When npx @thinqmesh/hrkit is run with no arguments, it defaults to
serve — the same as python -m hrkit serve.
Anything the underlying Python hrkit CLI accepts. The most common ones:
| Command | What it does |
|---|---|
npx @thinqmesh/hrkit serve | Start the app on your own machine at http://127.0.0.1:8765/. Browser opens automatically. The URL is local-only and stops working when you close the terminal. |
npx @thinqmesh/hrkit init <dir> | Scaffold a new HR workspace folder |
npx @thinqmesh/hrkit settings | Show or set BYOK API keys (AI provider, Composio) |
npx @thinqmesh/hrkit migrate | Apply pending DB migrations to the workspace |
npx @thinqmesh/hrkit status | Print workspace + database health |
npx @thinqmesh/hrkit activity | Tail the workspace activity log |
npx @thinqmesh/hrkit --help | Show all subcommands (delegates to the Python CLI) |
There is no hosted version of HR-Kit.
http://127.0.0.1:8765/is served by thehrkit serveprocess running on your own machine. It is unreachable from the public internet and dies the moment you stop the command.
Each HR module also adds its own subcommands (e.g. employee-add,
leave-approve, payroll-run-create). Run with --help to see them.
White-label your app instance via environment variables:
APP_NAME="Acme HR" # title shown everywhere in the UI
AI_PROVIDER="openrouter" # or "upfyn"
AI_API_KEY="sk-..." # your provider key
COMPOSIO_API_KEY="..." # for Gmail/Calendar/Drive integrations
You can also set these later via the in-app /settings page.
These tune how this npm wrapper bootstraps Python:
| Variable | Default | Purpose |
|---|---|---|
HRKIT_PYTHON | (auto-detected) | Absolute path to a specific Python interpreter to use |
HRKIT_INSTALL_SOURCE | pypi | Where to install from. pypi = pip install hrkit (default); git = pip install from the GitHub main branch (useful for testing unreleased features) |
HRKIT_PIP_NAME | hrkit | Override the PyPI distribution name |
HRKIT_GIT_URL | git+https://github.com/AnitChaudhry/HRKit.git | Override the GitHub install URL |
pip availableThat's it. No Docker, no databases to provision, no Redis.
This wrapper is intentionally tiny — under 200 lines of Node.js. On invocation it:
python3 / python / py -3 (Windows) until it finds a
working interpreter ≥ 3.10. Honors HRKIT_PYTHON if set.python -c "import hrkit" to check whether the Python package is
present.python -m pip install --user <source>.python -m hrkit <your args> with stdio: 'inherit' so you see
the Python app's output directly.The actual app, all the data, and all the logic live in the Python package at github.com/AnitChaudhry/HRKit. This package is just the install ergonomics for npm-native users.
"No Python 3.10+ interpreter found" — Install Python from
https://python.org/downloads/. On Windows, choose the "Add to PATH" option
during install, or use HRKIT_PYTHON=C:\path\to\python.exe.
"pip install exited with code N" — Run the printed command yourself to
see the full error. Most often it's a network issue or a missing build
toolchain (the Python deps for pydantic-ai-slim[openai]).
"hrkit installed but still not importable" — pip install --user
sometimes installs into a directory that isn't on the active Python's
sys.path. Try python -m site --user-site to see where, and ensure that
matches the Python the wrapper picked up.
MIT © HR-Kit contributors
FAQs
Local, white-label, AI-augmented HR app. One Python package, one SQLite file, no SaaS. This npm wrapper bootstraps and runs HR-Kit so users who only know npm can `npx @thinqmesh/hrkit serve`.
The npm package @thinqmesh/hrkit receives a total of 2 weekly downloads. As such, @thinqmesh/hrkit popularity was classified as not popular.
We found that @thinqmesh/hrkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.