
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A lightweight AI agent CLI tool that brings the power of LLMs to your terminal.
The Engineering-First Headless Agent Framework: Stable, Scalable Automation for the Post-Vision Era.
English | 简体中文
🔗 GitHub Repository: https://github.com/tsingliuwin/autoclaw
AutoClaw is a high-stability, open-source automation framework specifically engineered for headless systems.
Unlike "screen-seeing" agents (such as OpenClaw) that rely on visual interpretation, AutoClaw is built on a foundation of precise command-driven execution. This makes it significantly more stable, robust from an engineering perspective, and easier to scale across complex environments—whether it's a local server, a CI/CD pipeline, or thousands of containerized nodes.
-y, --no-interactive) for zero-touch automation.Install globally via npm:
npm install -g autoclaw
git clone https://github.com/tsingliuwin/autoclaw.git
cd autoclaw
npm install
npm run build
npm link
autoclaw setup
autoclaw
Simply run autoclaw to enter the chat loop.
autoclaw
> List all TypeScript files in the src folder.
Run a single command and exit.
autoclaw "Check disk usage and save the report to usage.txt" --no-interactive
Automatically approve all tool executions (dangerous, use with caution or in sandboxes).
autoclaw "Refactor src/index.ts to use ES modules" -y
-m, --model <model>: Specify the LLM model (default: gpt-4o).-n, --no-interactive: Exit after processing the initial query (Headless mode).-y, --yes: Auto-confirm all tool executions (e.g., shell commands).AutoClaw uses a hierarchical configuration system.
Priority Order (Highest to Lowest):
-m gpt-4o)OPENAI_API_KEY, .env file)./.autoclaw/setting.json in current directory)~/.autoclaw/setting.json)apiKey: Your OpenAI API Key.baseUrl: Custom Base URL (e.g., for DeepSeek or LocalLLM).model: Default model to use.tavilyApiKey: API Key for Tavily Web Search.smtpHost, smtpPort, smtpUser, smtpPass, smtpFrom: SMTP Email settings.feishuWebhook, dingtalkWebhook, wecomWebhook: Notification webhooks.Create a file at .autoclaw/setting.json:
{
"model": "gpt-3.5-turbo",
"baseUrl": "https://api.deepseek.com/v1"
}
⚠️ Security Warning: If you store your
apiKeyor secrets in.autoclaw/setting.json, make sure to add.autoclaw/to your.gitignorefile to prevent leaking secrets!
AutoClaw can search the web if you provide a Tavily API Key during setup or in config.
Configure SMTP settings to let the agent send emails.
Configure webhooks to receive alerts or reports in your team chat apps.
Built-in utility to provide the agent with the current system time, ensuring accurate handling of relative time requests.
When running AutoClaw inside a Docker container (especially Alpine or Debian Slim), screenshots of Chinese websites may display text as square boxes ("tofu") due to missing fonts. Emojis (e.g., 🔥) may also appear as squares.
Solution: Install CJK (Chinese/Japanese/Korean) and Emoji fonts in your container.
For Debian/Ubuntu:
apt-get update && apt-get install -y fonts-noto-cjk fonts-wqy-zenhei fonts-noto-color-emoji
For Alpine Linux:
apk add font-noto-cjk font-noto-emoji
MIT
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/AmazingFeature)git commit -m 'Add some AmazingFeature')git push origin feature/AmazingFeature)FAQs
A lightweight AI agent CLI tool that brings the power of LLMs to your terminal.
The npm package autoclaw receives a total of 93 weekly downloads. As such, autoclaw popularity was classified as not popular.
We found that autoclaw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.