
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Claude Project Manager - SDK and CLI for mono repo management with Claude Code projects
An SDK and CLI for managing mono repos with multiple Claude Code projects.
CLDPM enables sharing skills, agents, hooks, and rules across multiple Claude Code projects without duplication. It uses a hybrid linking strategy where references are stored in config files and symlinks are generated locally.
npm install cldpm
Or globally:
npm install -g cldpm
# Initialize a new mono repo
cldpm init my-monorepo
cd my-monorepo
# Create a project
cldpm create project web-app
# Create shared components
cldpm create skill logging
cldpm create agent code-reviewer
# Add components to project
cldpm add skill:logging --to web-app
cldpm add agent:code-reviewer --to web-app
# View project with resolved dependencies
cldpm get web-app
# Download project with all dependencies
cldpm get web-app --download --output ./standalone
# Get from remote repository (optimized sparse checkout)
cldpm get my-project -r owner/repo --download
# Use -b flag when branch name contains slashes
cldpm get my-project -r owner/repo -b feature/auth --download
# After git clone, restore symlinks
cldpm sync --all
import {
loadCldpmConfig,
resolveProject,
listProjects,
listSharedComponents,
syncProjectLinks,
} from "cldpm";
// Load configuration
const config = await loadCldpmConfig("/path/to/monorepo");
console.log(`Repo: ${config.name}`);
// List all projects
const projects = await listProjects("/path/to/monorepo");
for (const project of projects) {
console.log(`Project: ${project.name}`);
}
// Resolve a project with all dependencies
const project = await resolveProject("my-project", "/path/to/monorepo");
console.log(`Shared skills: ${project.shared.skills.map(s => s.name)}`);
// List all shared components
const components = await listSharedComponents("/path/to/monorepo");
console.log(`Skills: ${components.skills}`);
// Sync symlinks for a project
const result = await syncProjectLinks(projectPath, repoRoot);
console.log(`Created: ${result.created}`);
| Command | Description |
|---|---|
cldpm init | Initialize a new mono repo |
cldpm create project | Create a new project |
cldpm create skill/agent/hook/rule | Create shared components |
cldpm add | Add a shared component to a project |
cldpm remove | Remove a shared component from a project |
cldpm link | Link dependencies between shared components |
cldpm unlink | Remove dependencies between shared components |
cldpm get | Get project info, download with dependencies (local/remote) |
cldpm sync | Regenerate symlinks for shared components |
cldpm info | Show CLDPM information banner |
| Document | Description |
|---|---|
| CLI Reference | Complete CLI command reference |
| SDK Reference | Programmatic API documentation |
| Contributing | Contribution guidelines |
| Security | Security policy |
| Code of Conduct | Community guidelines |
import {
CldpmConfig,
ProjectConfig,
ProjectDependencies,
ComponentMetadata,
ComponentDependencies,
ComponentType,
createCldpmConfig,
createProjectConfig,
createComponentMetadata,
parseComponentRef,
} from "cldpm";
import {
// Config
loadCldpmConfig,
saveCldpmConfig,
loadProjectConfig,
saveProjectConfig,
getProjectPath,
listProjects,
loadComponentMetadata,
saveComponentMetadata,
// Resolver
resolveProject,
resolveComponent,
resolveLocalComponent,
listSharedComponents,
resolveComponentDependencies,
getAllDependenciesForComponent,
// Linker
syncProjectLinks,
addComponentLink,
removeComponentLink,
createSymlink,
removeProjectLinks,
getLocalComponents,
getSharedComponents,
} from "cldpm";
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
# Watch mode
npm run dev
MIT License - see LICENSE for details.
Crafted by Transilience.ai
FAQs
Claude Project Manager - SDK and CLI for mono repo management with Claude Code projects
We found that cldpm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.