
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
anti-default
Advanced tools
Un-Default — inclusive language review for AI-generated and human copy (CLI, MCP, GitHub Action, extension). npm name is anti-default because un-default is blocked by an unrelated package.
Formerly Anti-Default. Same tool — the name shifted so it reads as undoing defaults, not opposing people. Old URLs under
darkai.ca/anti-defaultredirect here.npx anti-defaultstill works as an alias fornpx -y anti-default.
Un-Default reviews copy, docs, UI strings, and live pages for colonial defaults, gendered assumptions, ableist metaphors, and documented dogwhistles. It explains what it noticed and offers clearer alternatives.
No account. No AI required for matching. Open rules you can tune.
After Claude writes UI copy · Try the web app · Add the Chrome extension · Star on GitHub
One command — skill + MCP + PR check. This is the habit that sticks:
npx -y anti-default init
Paste-ready MCP JSON, Claude Project instructions, and a LinkedIn draft:
https://darkai.ca/un-default/for-agents/
{
"mcpServers": {
"un-default": {
"command": "npx",
"args": ["-y", "anti-default", "mcp"]
}
}
}
| Host | Where it goes |
|---|---|
| Cursor | .cursor/mcp.json (written by init) or Settings → MCP |
| Claude Desktop | Settings → Developer → Edit Config → claude_desktop_config.json (merge, quit, relaunch) |
| Claude Code | .mcp.json at repo root (written by init) or claude mcp add |
Tools: un_default_scan · un_default_fix · un_default_feedback
npx -y anti-default .
That is the whole local setup. It prints findings and exits non-zero on clear hits. Ambiguous or quoted matches stay advisory.
To pin it in a team project:
npm install --save-dev anti-default
Want the complete project setup?
npx -y anti-default init
init adds an ignore file, changed-files GitHub workflow, Cursor + Claude
skills, .cursor/mcp.json + .mcp.json, and inclusive-check /
inclusive-fix scripts. Existing files are never overwritten.
npx -y anti-default fix . # safe 1:1 autofixes only
npx -y anti-default . # remaining findings
Agents should not mark UI/docs work done until hard findings are cleared or explicitly marked fine in context. Soft/coded hits stay advisory.
# Preview autofixes without writing
npx -y anti-default fix . --dry-run
# Intentional language — suppress locally + share structured feedback
npx -y anti-default feedback --kind fine_in_context \
--rule guys-generic --match "guys" --context "…snippet…" \
--note "Quoted lyric" --open-issue
npx -y anti-default mcp
See for-agents for host-specific paste steps.
# Paths
npx -y anti-default ./src ./docs README.md
# CI formats
npx -y anti-default . --format json -o report.json
npx -y anti-default . --format sarif -o results.sarif
# Batch URLs — no Review UI
npx -y anti-default --urls https://example.com https://example.com/about
npx -y anti-default --urls-file urls.txt --format json
# Only files changed in this branch
npx -y anti-default . --changed-from origin/main
# Keep existing findings quiet; report only new ones
npx -y anti-default baseline .
Commit a .undefaultignore so day-two noise doesn’t drown the team (example):
node_modules/
vendor/
*.min.js
rule:guys # turn off one rule for this repo
Keep inclusive language in the PR loop. This scans only changed files, fails on clear new findings, and leaves a checklist comment:
# .github/workflows/un-default.yml
name: Un-Default
on: [pull_request]
permissions:
contents: read
pull-requests: write
security-events: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: NomadBuilder/un-default@v1
with:
changed-from: ${{ github.event.pull_request.base.sha }}
format: json
comment-on-pr: "true"
Prefer SARIF for Code Scanning? Set format: sarif and output-file: un-default.sarif. Full inputs: action.yml.
npx -y anti-default init installs .cursor/skills/un-default/SKILL.md — the
definition-of-done workflow for AI-generated copy: fix → scan → ask or
feedback → re-scan.
Source: skills/un-default/SKILL.md ·
feedback model: feedback/README.md
The npm package has no runtime dependencies and exposes the same analyzer used by the CLI and web app:
import { analyzeText, LANGUAGE_RULES } from "anti-default";
const result = analyzeText("Welcome, you guys.");
console.log(result.findings);
Same rules as the app — on the page you’re already looking at.
Runs offline from a bundled rule list. No tracking. No AI calls.
Dev / unpacked: npm run extension:pack → Load unpacked → extension/ · details in extension/README.md
npm install && npm run dev # localhost:3000
Every suggestion cites the style guides and references behind it → /sources
src/lib/rules.tsnpm run corpusnpm run build → out/STATIC_EXPORT=true BASE_PATH=/un-default npm run buildProduction lives at darkai.ca/un-default and is also vendored in DarkAI.
FAQs
Un-Default — catch racist, sexist & ableist defaults in AI and human copy (CLI, MCP, GitHub Action, extension). npm name is anti-default because un-default is blocked by an unrelated package.
The npm package anti-default receives a total of 67 weekly downloads. As such, anti-default popularity was classified as not popular.
We found that anti-default demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.