
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
This repository is a source checkout of Claude Code that runs directly with Bun. It is organized for direct development: application code lives under src/, operational scripts live under scripts/, and repository docs live under docs/.
PATH (latest stable is recommended).claude login) or OpenRouter (see below)..
├── docs/ Maintainer and architecture notes
├── public/ Static assets
├── scripts/ Local automation and code generation
└── src/ Application source
Key source areas:
src/entrypoints/: Bun entrypoints and SDK-facing contractssrc/cli/: CLI transport and command wiringsrc/commands/: command implementationssrc/components/: Ink UI componentssrc/services/: integrations and orchestrationsrc/tools/: tool implementations and promptssrc/utils/: shared infrastructure and helpersSee docs/architecture.md for the source tree map.
Clone the repo and cd into it:
git clone https://github.com/ashish200729/claude-code.git
cd claude-code
Install dependencies:
bun install
Start the CLI from source (from this directory, or via a global link):
bun src/entrypoints/cli.tsx
Optional: a global ashishcode command (same CLI as bun src/entrypoints/cli.tsx, with a few extra env vars for parallel tool execution):
bun link --global
ashishcode
Backward-compatible local alias:
claude-local
There is no separate production build for day-to-day use: the entrypoint is src/entrypoints/cli.tsx. The shipped product is a different package; here you run the repo directly.
bun run cli
node scripts/emit-core-types.mjs
node scripts/emit-control-types.mjs
Minimal smoke check:
bun run cli --help
bun install.bun run cli.src/ and keep repository-level scripts and docs in sync when entrypoints move.The key is stored in Claude Code’s global config: ~/.claude.json → env, together with the flag that routes traffic to OpenRouter.
Pick one approach (the binary is named claude in --help; from source use bun src/entrypoints/cli.tsx, ashishcode, or claude-local):
# pass the key as an argument
bun src/entrypoints/cli.tsx auth openrouter set sk-or-v1-...
# or use OPENROUTER_API_KEY if it is already exported in your shell
bun src/entrypoints/cli.tsx auth openrouter set
# or pipe from stdin (handy for secrets)
echo "$OPENROUTER_API_KEY" | bun src/entrypoints/cli.tsx auth openrouter set --stdin
After a successful run, new sessions default to OpenRouter (OPENROUTER_API_KEY and CLAUDE_CODE_USE_OPENROUTER=1 are written to config).
bun src/entrypoints/cli.tsx --api-provider anthropic
bun src/entrypoints/cli.tsx auth openrouter clear
(This only clears what is stored in ~/.claude.json — not a key you export manually in the shell.)
| Variable | Purpose |
|---|---|
OPENROUTER_BASE_URL | Defaults to https://openrouter.ai/api |
OPENROUTER_HTTP_REFERER | HTTP Referer for OpenRouter |
OPENROUTER_APP_TITLE | App title sent to OpenRouter |
/modelIn an interactive session:
/model — opens the interactive model picker./model sonnet, /model opus, /model haiku, etc. — set the model by alias when your account/org allows it./model default — revert to the default from your settings.You can also pass a full model id for the active provider — with OpenRouter, ids look like their catalog (anthropic/claude-sonnet-4.6, openai/gpt-4o, …). What actually works depends on OpenRouter and any org allowlist.
From the shell (before the REPL):
bun src/entrypoints/cli.tsx --api-provider openrouter --model anthropic/claude-sonnet-4.6
bun installbun src/entrypoints/cli.tsx auth openrouter set <key> (or claude login for Anthropic)bun src/entrypoints/cli.tsx → use /model inside the session to switch modelsIf something fails, confirm bun --version works and your key is valid for OpenRouter.
ashishcodeLocal release checks:
bun run test:release
bun run cli --help
npm pack --dry-run
Publish the public package:
npm login
npm publish --access public
Install globally after publish:
npm i -g ashishcode
ashishcode
This package runs the source CLI through Bun, so Bun must be installed on the target machine.
FAQs
Source-run Bun CLI for Claude Code workflows with multi-provider support.
The npm package ashishcode receives a total of 3 weekly downloads. As such, ashishcode popularity was classified as not popular.
We found that ashishcode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.