
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The pre-alpha version of a light weight personal AI assistant. It is a coding exercise for understanding the famous openclaw project.
It is not fully working and absolutely far from being useful :).
The clawlet is just a simple nodejs application, which uses a local llm and talks via telegram.
So you will need 3 things:
There is a script called launch-mlx.sh which you can use to run the local llm on port 127.0.0.1:8000. For this
it uses homebrew to install python3.11 if not available, creates a .venv for python and installs mlx-lm into
it and then installs mlx-openai-server.
$ ./launch-mlx.sh
If you want to talk to it via telegram - create a bot (see telegram documentation on bot creation)
and store the id of the user and the token in .env as follows:
TELEGRAM_USERINFO_ID=
TELEGRAM_BOT_TOKEN=
If you want to use the published release use:
$ npx clawlet
If you cloned this repository run:
$ pnpm install
$ pnpm start
SYSTEM_INSTRUCTIONSmemory/[YYYY-MM-DD]/[HHmm]-[slug].md<tool_call> with llm repairclawlet is copyright 2026 by DracoBlue and licensed under the MIT License.
FAQs
A lightweight AI based personal assistant.
We found that clawlet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.