
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ccrun is a CLI tool that provides a user-friendly wrapper around the Claude Code one shot mode. It simplifies interactions with Claude through command-line interfaces by supporting direct prompts, file inputs, and flexible permission control.
git clone https://github.com/kykt35/ccrun.git
cd ccrun
npm install
npm run build
To run the TypeScript file directly:
npx ccrun -i "Hello"
-i, --input <prompt>: Specify prompt directly (optional)-f, --file <file>: Read prompt from file-c, --continue: Continue session-h, --help: Show help--max-turns <number>: Specify maximum number of turns--resume <session-id>: Resume from session ID--allowed-tools <tools>: Specify allowed tools (comma-separated)--disallowed-tools <tools>: Specify disallowed tools (comma-separated)--permission-mode <mode>: Set permission mode (default|plan|acceptEdits|bypassPermissions)-s, --settings-file <file>: Specify settings file--system-prompt, -sp <prompt>: System prompt for Claude--system-prompt-file, -sp-f <file>: Load system prompt from file-csp, --custom-system-prompt <prompt>: Custom system prompt for Claude (deprecated)-o, --output: Enable output with auto-generated filename--output-file <file>: Specify output file path--output-dir <directory>: Specify output directory (default: ./tmp/ccrun/results)--output-format <format>: Output format (json|text, default: text)--output-enabled: Enable output (same as --output)# Specify prompt directly
npx ccrun -i "Write TypeScript code"
# Read prompt from file
npx ccrun -f prompt.txt
# Show help
npx ccrun -h
# Use system prompt to define Claude's role
npx ccrun -i "Review this code" --system-prompt "You are a security expert focused on finding vulnerabilities"
# Short form for convenience
npx ccrun -i "Explain this algorithm" -sp "You are a computer science professor teaching algorithms"
# Load system prompt from file
npx ccrun -i "Optimize this function" --system-prompt-file ./prompts/typescript-expert.txt
# Short form for file loading
npx ccrun -i "Code review" -sp-f ./prompts/security-reviewer.txt
# Combine with other options
npx ccrun -f code.txt --system-prompt "You are a senior code reviewer" --max-turns 5
# Legacy syntax (deprecated but still works)
npx ccrun -i "Legacy example" --custom-system-prompt "You are a TypeScript expert"
# Continue previous session
npx ccrun --continue -i "Please explain more"
# Resume specific session
npx ccrun --resume <session-id> -i "I have additional questions"
You can resume sessions with claude command.
# Continue previous session with claude interactive mode
claude --continue
# Resume specific session with claude interactive mode
claude --resume <session-id>
# Allow specific tools only
npx ccrun -i "Read the file" --allowed-tools "Read,Write"
# Disallow specific tools
npx ccrun -i "Execute the code" --disallowed-tools "Bash"
# Combine multiple tools
npx ccrun -i "Analyze the project" --allowed-tools "Read,Grep,Glob" --disallowed-tools "Write,Edit"
# Specify custom settings file
npx ccrun -i "Read the file" --settings-file ./my-settings.json
# Short form also available
npx ccrun -i "Analyze the project" -s ../shared-settings.json
Save execution results to file. Output is disabled by default and must be explicitly enabled.
# Enable output (auto-generated filename: ./tmp/ccrun/results/yyyyMMddHHmmss.text)
npx ccrun -i "Analyze the code" --output
# Short form works too
npx ccrun -i "Analyze the code" -o
# Save to specific file
npx ccrun -i "Analyze the code" --output-file results.txt
# Explicit output file specification
npx ccrun -i "Analyze the code" --output-file results.txt
# Save to custom directory
npx ccrun -i "Analyze the code" --output --output-dir ./output
# Save in JSON format
npx ccrun -i "Fix the bug" -o results.json --output-format json
# Disable output (default behavior, console output only)
npx ccrun -i "Analyze the code"
# Combine multiple options
npx ccrun -f input.txt --output --output-dir ./results --output-format text
# Limit maximum turns
npx ccrun -i "Let's have a long discussion" --max-turns 10
# Combine multiple options
npx ccrun -f input.txt --continue --max-turns 5 --allowedTools "Read,Write"
# Complex combination with system prompt
npx ccrun -i "Analyze this codebase" \
--system-prompt "You are a senior software architect with expertise in code quality" \
--allowedTools "Read,Grep,Glob,LS" \
--max-turns 15 \
--output-file analysis.json
Run the following in the project root:
npm run build
npm link
Now you can use the ccrun command from any directory.
Example:
ccrun -i "Hello"
You can create settings in .ccrun/settings.json or .ccrun/settings.local.json:
{
"permissions": {
"allow": ["Read", "Write"],
"deny": ["Edit"]
},
"maxTurns": 25,
"systemPrompt": "You are an expert TypeScript developer with extensive knowledge of modern web frameworks",
"outputFile": "./results/output.txt",
"outputFormat": "text",
"output": {
"enabled": true,
"directory": "./results",
"filename": {
"prefix": "ccrun-",
"suffix": "-result"
}
}
}
You can specify any settings file with the --settingsFile option:
npx ccrun -i "prompt" --settingsFile ./custom-settings.json
--settingsFile.ccrun/settings.local.json.ccrun/settings.json{
"permissions": {
"allow": ["Read", "Write", "Edit"],
"deny": ["Bash", "WebFetch"]
},
"maxTurns": 50,
"systemPrompt": "You are a security expert focused on code analysis and vulnerability detection",
"outputFile": "./project-results/analysis.txt",
"outputFormat": "text"
}
{
"permissions": {
"allow": ["Read", "Write", "Edit"],
"deny": ["Bash", "WebFetch"]
},
"maxTurns": 50,
"systemPrompt": "You are a senior software architect specializing in performance optimization",
"outputFormat": "text",
"output": {
"enabled": true,
"directory": "./project-results",
"filename": {
"prefix": "analysis-",
"suffix": "-report"
}
}
}
The project includes an example settings file:
.ccrun/settings.example.json){
"permissions": {
"allow": ["Read", "Write", "Edit", "MultiEdit", "Glob", "Grep", "LS"],
"deny": ["Bash", "WebFetch", "WebSearch"]
},
"maxTurns": 30,
"systemPrompt": "You are an experienced software engineer with expertise in code analysis and refactoring",
"outputFile": "./tmp/output.txt",
"outputFormat": "text",
"output": {
"enabled": true,
"directory": "./tmp/test",
"filename": {
"prefix": "test",
"suffix": "suf"
}
}
}
# Use example settings
npx ccrun -i "Analyze the code" --settingsFile .ccrun/settings.example.json
# Copy example settings to create your own
cp .ccrun/settings.example.json .ccrun/settings.local.json
npx ccrun -i "prompt" --settingsFile .ccrun/settings.local.json
You can output execution results to files.
ccrun supports two output formats:
Human-readable report format.
--- Execution Summary ---
Session ID : session-abc123
Status : Success (success)
Timestamp : 2025-07-09 12:34:56
Execution Time : 2,500ms
API Time : 2,100ms
Turn Count : 3
Estimated Cost : $0.0042
--- Token Usage ---
Input Tokens : 1,250
Output Tokens : 380
Total Tokens : 1,630
--- Result ---
Execution result content
Structured data format compliant with Claude Code SDK's standard format (SDKResultMessage).
{
"result": {
"type": "result",
"subtype": "success",
"duration_ms": 2500,
"duration_api_ms": 2100,
"is_error": false,
"num_turns": 3,
"result": "Execution result content",
"session_id": "session-abc123",
"total_cost_usd": 0.0042,
"usage": {
"input_tokens": 1250,
"output_tokens": 380,
"total_tokens": 1630
}
},
"metadata": {
"timestamp": "2025-07-09T12:34:56.789Z",
"config": {
"maxTurns": 10,
"allowedTools": ["Read", "Write"]
}
}
}
systemPrompt insteadjson or text)For All Settings:
--system-prompt, --max-turns, --allowedTools)For Output Settings:
--output-file, -o, --output, --output-enabled)outputFile in settings fileoutput.enabled: true in settings file (auto-generation)Note: CLI arguments always override settings file values for the same option.
./tmp/ccrun/results/yyyyMMddHHmmss.text format (execution start time)MIT
FAQs
A tool to make Claude's one shot mode more user-friendly
We found that ccrun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.