
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@viberaven/cli
Advanced tools
VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.
VibeRaven is the Card Table — a local Studio where your AI-built app is laid out in front of you. Every provider (Supabase, Vercel, Stripe, ...) is a graded trading card in your hand: play a card and its production checks run instantly in chat; a RAVEN GRADE 10 means that territory is production-ready. Versions are a pile you can pull from, your whole architecture is a region map of cards, and Codex, Claude Code, or Gemini CLI does the actual work — with you controlling how much it's allowed to touch.
npx -y viberaven
That command opens the table:
ask / approve / full access modes and inline approve for risky work.The unscoped viberaven package is a small shim that launches this CLI package.
Inside the Studio, connect an installed CLI and test it before chat control:
Installed is not the same as connected. VibeRaven asks the selected CLI to prove it can run in the current repo before using it for real chat work.
Use the Studio side tabs and context chips to attach provider or version context to a chat mission:
Provider dashboard checks are not cleared by repo-code edits. Billing/product configuration, DNS, webhooks, credentials, quotas, and live provider verification must still be completed or verified in the provider dashboard or through read-only provider evidence.
The Studio is the default product surface. These commands remain available for automation and CI:
npx -y viberaven check --json
npx -y viberaven --strict --json
npx -y viberaven actions
npx -y viberaven --verify --action VR-A1
For focused work:
npx -y viberaven next --json
npx -y viberaven prompt --gap <id>
npx -y viberaven audit --vercel-supabase
--agent-mode is kept for older artifact-first agent workflows:
npx -y viberaven --agent-mode
It writes artifacts such as:
.viberaven/agent-tasklist.md.viberaven/gate-result.json.viberaven/context-map.json.viberaven/agent-summary.md.viberaven/launch-playbook.mdNew product work should prefer the Studio and MCP/chat context flow instead of the old tasklist-first loop.
Use the MCP package when an agent host supports MCP tools:
npx -y @viberaven/mcp
The MCP server wraps the public CLI and exposes readiness, verification, action, audit, and healing tools without exposing secrets.
npm --prefix packages/cli run typecheck
npm --prefix packages/cli test -- local-ui/server.test.ts
npm --prefix packages/cli run build
For a local package publish check, run from this package directory:
cd packages/cli
npm pack --dry-run
MIT
FAQs
VibeRaven CLI and local Studio: Supabase RLS and security check for AI-built Vercel + Supabase apps, with an agent task list and fix prompts.
The npm package @viberaven/cli receives a total of 653 weekly downloads. As such, @viberaven/cli popularity was classified as not popular.
We found that @viberaven/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.