
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
atrisDev (atris dev) - CLI for AI coding agents. Works with Claude Code, Cursor, Windsurf. Make any codebase AI-navigable.
atris is a self improving context layer for your agent. Works with coding agents like Claude Code and Cursor.
If you're a coding agent (Claude Code, Cursor, Windsurf, Copilot, etc.) reading this:
When the user asks to build/plan/fix something, run:
atris
Follow the instructions in the output. The full protocol is in atris.md.
npm install -g atris
cd your-project
atris init # Creates atris/ folder
atris # Loads context, ready to build
Then describe what you want to build. The agent will:
0. (Optional) Explore with atris brainstorm if uncertain
atris/features/[name]/idea.md + build.md + validate.mdCommands: brainstorm (optional) → plan → do → review
Works with: Claude Code, Cursor, Windsurf, GitHub Copilot, any agent.
Atris also supports Karpathy-style keep/revert loops inside atris/experiments/.
atris experiments init self-heal
atris experiments validate
atris experiments benchmark
atris upgrade # Install latest from npm
atris update # Sync local files to new version
Atris includes agent-agnostic skills that work with Claude, Cursor, Codex, any LLM:
| Skill | Purpose |
|---|---|
| atris | Workflow enforcement + plan/do/review |
| autopilot | PRD-driven autonomous execution |
| backend | Backend architecture anti-patterns |
| design | Frontend aesthetics policy |
| meta | Metacognition for agents |
| writing | Essay process with approval gates |
Install to Codex: cp -r atris/skills/[name] ~/.codex/skills/
License: MIT | Repo: github.com/atrislabs/atris
FAQs
atrisDev (atris dev) - CLI for AI coding agents. Works with Claude Code, Cursor, Windsurf. Make any codebase AI-navigable.
The npm package atris receives a total of 256 weekly downloads. As such, atris popularity was classified as not popular.
We found that atris demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.