
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
clay-system
Advanced tools
Tiny global npm shim for the local Clay/Loom system.
This package intentionally does not ship Clay weights, training artifacts, or
the Loom repository. It installs a global clay command that calls the real
checkout at C:\dev\loom by default, or $CLAY_LOOM when set.
Use this package name for new installs. Compatibility alias:
@izdandavis/clay should not be installed next to
clay-system, because both expose the same global clay binary.
npm install -g clay-system
If npm's package metadata endpoint lags, install the published tarball directly:
npm install -g https://registry.npmjs.org/clay-system/-/clay-system-0.1.3.tgz
clay --help
clay --shim-version
clay doctor
clay --help, clay --shim-version, and clay doctor are handled by this npm
shim directly. They do not require the full Loom checkout to be working.
clay update
That fast-forwards the Loom checkout, updates this npm shim, rebuilds the Clay Ollama persona, and writes receipts under:
C:\dev\clay_home\training\updates
If the checkout does not exist yet:
clay update --clone
Dry-run:
clay update --dry-run --skip-persona
Scheduled Windows update:
clay update install-scheduled
The scheduled task skips npm updates until the package is published. After the npm package is live, recreate it with:
clay update install-scheduled --include-npm
If clay doctor says clay.ps1 is missing, either clone Loom:
clay update --clone
or point the shim at an existing checkout:
$env:CLAY_LOOM="D:\path\to\loom"
clay doctor
The npm package has a publish gate. Before publishing, run:
npm run publish:check
That verifies metadata, direct CLI behavior, fresh tarball install behavior, and the final package contents. It also runs:
npm run quality:score
The local controllable package score must be 10/10 before publish.
To finish the public registry update after npm browser/2FA authentication:
npm run registry:finish
That publishes clay-system and marks the old @izdandavis/clay package as a
compatibility alias pointing users to clay-system.
FAQs
Global Clay CLI shim and self-updater for the local Loom/Clay system.
We found that clay-system demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.